hxxps://www[.]dlsite[.]com/modpub/promo/oversea/maniax/en_RJ01013038_e9b/?utm_source=tenyi&utm_medium=display&utm_campaign=gameR_ovs_te&utm_content=en_RJ01013038_e9b&vid=wljllt803119rgmr2aq101l8

Analysis

max time kernel
148s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07/07/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dlsite.com/modpub/promo/oversea/maniax/en_RJ01013038_e9b/?utm_source=tenyi&utm_medium=display&utm_campaign=gameR_ovs_te&utm_content=en_RJ01013038_e9b&vid=wljllt803119rgmr2aq101l8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
224	msedge.exe
224	msedge.exe
3404	msedge.exe
3404	msedge.exe
1856	identity_helper.exe
1856	identity_helper.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3228	224	msedge.exe	80
PID 224 wrote to memory of 3228	224	msedge.exe	80
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 2784	224	msedge.exe	82
PID 224 wrote to memory of 4492	224	msedge.exe	83
PID 224 wrote to memory of 4492	224	msedge.exe	83
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84
PID 224 wrote to memory of 4828	224	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dlsite.com/modpub/promo/oversea/maniax/en_RJ01013038_e9b/?utm_source=tenyi&utm_medium=display&utm_campaign=gameR_ovs_te&utm_content=en_RJ01013038_e9b&vid=wljllt803119rgmr2aq101l8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbfec03cb8,0x7ffbfec03cc8,0x7ffbfec03cd8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,14569699302329424089,3046069387573654857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b45c28d31ee31580e85d12f5ce5b6a46

SHA1
8bd9a23f3141aa877711fc7835446b8783b51974

SHA256
d944d6021a2fdf016911aa4d9e8b437431fa4f92b0229b9e3322b4354a4b19c7

SHA512
3628da551c52367a4b54ca0cb7c401f7d3a8dd37375b3b57d82adb06c96657ac55d593ffa7a9f000f74ecd7e6d35562a96013d0c70b04123f055a4d2af72aa3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
640b9bae54d22b45b4d52a96e2f81f13

SHA1
b1c7304e9abbe1759f8df7f88ca2c6354b42fdf3

SHA256
834c17e205445d197a64177b76ae0bb718bfe2eb8ffe492f008946603edf80d4

SHA512
8baaa3339cddca01a018e9a0900426a7590f7107c55372d65fe932dd570bb4289238977396037c9bf73157d6bfd7f1f5795842df39c354200c2af1a84014e6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4c4ac1feb49ab1f22b91e866f5d9c4f1

SHA1
d5a236bd4803ce06b4e6d0148d90beaba6afcea0

SHA256
6f1f82548cb495e0d4681a01190cc1cc470bf202554174ce895e9f348d765da7

SHA512
a3338b5a66c8e0861da034a48a7ac77e83009961d8a4796066fb9a33ee2109f078929e7506b5582d352f468e1451c2c6490f705aa3a8618f63da06b3267850a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd0d71f53b2b31f4db1ded489f159d3d

SHA1
83da1eede0ea2ad2806d9e24920c8d2e281c4f87

SHA256
330ad1f89340bc87c90bcb08c93698126bdbd1d9b8bcecc57cd1f5d0ed74d4c3

SHA512
650c09b75cb3cd43cb34ea34debdb4157dfb4df6d5f94bd6c4ab62d747f6e155201259295ef9504f62b5b46b71921550a6b7933ae6573eaf3ed9612962260acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
52fda2cb1f72966800a3f7a81cde3747

SHA1
6d5a8a164504e91be75fbec2b4e9838ea07d9d78

SHA256
3fcd4765d76a865d9a740a4e8bf53523fa750bf24367532932f5a37322efd4ff

SHA512
ec858b8eb10df3d13c0f6760f015ac674f500d73943f81546217f883e6ed69f3de80958d0a20179a49e6a467a216b5e0b4759714701a0f770ca9fe1af13bd984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
43f439c06805c01a6951c50c198ae74d

SHA1
efd767623878c428cbfcc442ef127bc5412e05ef

SHA256
0c7dd27c3521de2dfb9d66c7cbf724cd2859eae0ab52b388392298ac18688489

SHA512
67e8e56b5c4d621296ad51855ee4d261dd4bd96ec85b4a251692d5a4db5832c3324eede30ed3d991686bb9a253ee54b607f2bc1b2cead2f2d111da022a574bbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb1ea2c08cfd9c32ea1af4c09e2fe9a3

SHA1
4476a4b8cd157e74e6a3c331424838d00aeae1a0

SHA256
85af712bfb3f0702dafec2188312109bc3eb59340a291b4de6870cbea037e1a6

SHA512
b177475a006b3d43269009f5170456bebeb74c5f3d06f3efb05d2939552bd02f9b68fbd25c3d94f87d50e50ff049448687eb8e04647e424fa1f72bad18d417d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00ace59b5d04231ba10659ba6943cd54

SHA1
1d95680139c2ea69cae7ed124701d25d9ab2f77f

SHA256
8aa891e18edddf17f2db52a50239a35d7da43c76f4cccc1873e3b987792cbf0d

SHA512
5ef1f1d788eb29617fb31363882fdf4281907523fd72078eef35ea36b5d95d647d819b8003c54a887fae8d382d7dcfcfe345fe4b75f0c8247e8925c1ad51b60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
502aa21dff0ea3090ef0cd6e230c0710

SHA1
2bfaae2c7c0778905397c1de2b9a32b7146555a8

SHA256
1c90a59d3a0562d1823a5190bb6e8b7733b585d0cad238730b980085c993f668

SHA512
514ff689a925fe2fc2c40e2591ca3dceddbe6b52b0721789061732b5ac0315fa9e42cbda115e6f776510af970cb52d3dea8d7955295c2307926d8e63baa8a8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58273a.TMP

Filesize
1KB

MD5
c5c08326c71c0687b07929b3644038e3

SHA1
82e095b95f3db96174cdada6ca5c63702f371440

SHA256
82a7aefbd71672ad6d3312f4681db9eca5394c84f09e40b5c9f24af65da53dac

SHA512
6672a69874d73db4b14007b784e31a49ac135cee8a2f44f91e43cb74704db7ad5aa9682072902444f2dd38564b44b143e29c003c5d44265adef88215f8e05cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab33a876307b586098f3d0962a1f6366

SHA1
a562c033f7c6d3f523a2e5f093e915919c626f32

SHA256
a85eabe6c0ba79e75255e1bc22d5a5ce52e6c813e48e51507c28b1c3ff77f29d

SHA512
e8fe93556cf36373aa2dfe9239ad5775d1296c8d349a2cee50127bd7a1dc105019d883f4118ad23f76f8622dd2ba3f61b5d116c65a9136b8ccff7da5b8203b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f537ba782b16cc0be02b5d2264f36e3

SHA1
c9dc5375283e9ab61c23e03e9f2a7c9c4fcf6e5f

SHA256
86c8c6186d001d84aa45c1f41602d330d33ad64f40117b47915b3799198a46cb

SHA512
639251f497ec0a67362c05ba16f538e9e713d3d01eb8ee277449845d501fd46b4a36027ab6c95a1cf99713895f4384908d68a13fdcf9018da5034be1d30aeb0b

Download Submit