hxxp://itch[.]io

max time kernel
64s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10/11/2024, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://itch.io

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
4348	msedge.exe
4348	msedge.exe
3832	msedge.exe
3832	msedge.exe
2508	identity_helper.exe
2508	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4084	4348	msedge.exe	77
PID 4348 wrote to memory of 4084	4348	msedge.exe	77
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 4144	4348	msedge.exe	78
PID 4348 wrote to memory of 860	4348	msedge.exe	79
PID 4348 wrote to memory of 860	4348	msedge.exe	79
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80
PID 4348 wrote to memory of 580	4348	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://itch.io
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda8f13cb8,0x7ffda8f13cc8,0x7ffda8f13cd8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5439990610678606901,2983861408981271450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
978bdaca0bfd6c02f0451ef4f5e6f8ce

SHA1
f1bb12f38c9a31bf9dd1f20a1418b6a0ce262e70

SHA256
55dfdf5bc3a4eef1c90dcbe8b3914f4cad40a6e7f50c9fd7fb12de2db72b365a

SHA512
66d6f826983c8e6f3e9a5a230ca82497e4cfd0e967ca260f3df0716d8a97958ead7420eb90837ffa33fc480a81e6bb8cf03685658c0783e1438b3e39deb95951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1ead8bc9cd14d564ec88ad120f168da9

SHA1
e99b4ede7938f14ca612655b8f7751512646ea2e

SHA256
d79d40225296602d5a14b2d9a665b12d045bdde87086b77b2b530de22954f999

SHA512
bd4a861e19d54f84e6bde4f9cfc3e50beca946bb350e849c723dc3d5c3bef0610a02c2c447e8414566edb6714d2e25c510be74207d0c1485a561eaa7c4efb6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23b41e40f75b74e9da72172460a9adb0

SHA1
54810e96f74196c1a7ee6f0c38f2e7a1c160a30a

SHA256
36abc4d8ccce04333333d47960b7d8ede1f51ec34709561fe67b6bef4dcdd9d4

SHA512
26ef15d23e40fd2b371d19a8aad711027ba52088465a08d4de17717ddf10e5a377de2e160cdfd3523eff96a07ae10a7bddd23a91b0c7e0b36f1b63438e175afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3ca9a74e18e9cc441521e9318bc917e

SHA1
72146b2fcb3ada487f0a706419192bbf6b48e42f

SHA256
960d9481e8bd07ed897c572f6af8fb29fdde6e29cceebe9370621e84ae189b46

SHA512
729dd1242d452409116941ef74044f28f7c25320920a5b52392b4c28d14e9503259ae6a44f9bbe1e7e2be579f2f59a3648d5ad8cf42ee1b7dcdff34de9672ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d35b0bbee4324b27691d515a0f387bfb

SHA1
4bfaeed592f2b0e0fbac22f8468e9cd4f46b857e

SHA256
3d3ee176d645dc06b281f9c12bcc99f58530f9fb8f9830e8dcee8117007157ff

SHA512
de6468489e2983e9e3765f32e293d76f57928e1843fce561148015a68f93dc8083936e081b03b5084d6a176bd630797cfdd2a2b1611d9aafcb07648632893e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
269a28299e36eda102c304293c4f776f

SHA1
bd436f801eb327169e7b5214374f3777295ace0c

SHA256
95c5ebd03599dc519f44097071a829346a6de6012d959827733d157a9231f222

SHA512
764836b69ed7448587ea4892276d15600cc44c0488057991523b1523de488f29115209dffd9a993bc58e2d9dbccffc1c332fa205048e7af7fa52f97e135d4e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580819.TMP

Filesize
48B

MD5
74759cbcf87b60f66aa015ed900a45fb

SHA1
761646fbab0ab8f728925d0ce90c7029d5a6b5e0

SHA256
c6ef236209fdb9b99311ba0a8939d50e0979e62c3d791d498051e3a76d2ed92d

SHA512
4d1fd445061d4f941a45b5ed16b0be653827b5b876e678fc8e6592d6953527df9a05a8de399d5094cdd6adc836fd80558c7be85a78d4211d1b5beb365587839b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e4fc636ec889a4ddf74c453bd2645614

SHA1
b8cfec1cb5303d87f53ed736cdab4453ec678e37

SHA256
2efa7d91fece0a8c3850c1e82c3877d2f829f4c4b2bb86a5568e79aeb08928c1

SHA512
42d64e66b1ffd1aca4f6653fdc39c4505ac4216e447efd93ae0d22e7052bdd20e905189853b0ce280804edf29afa044be408d9179a174a07d0577a8dfe5a5b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
bc733fd89120fa3e272263b66fcc5339

SHA1
d8bde2e2b247a286dc0c4857c8461e1e4a520d51

SHA256
c5e42a2cd99003a8f3f63762625e63cceac0adb24ce0a793d2bdce8ca9ab5b3e

SHA512
3a6ee343f423bad0a4de15064fd61a9e2bf50c2354c5b23ae7439af939a2f47f411d101e6e8cc74c40a52be71e3ae30ef8ced8335fd66124d2061b6ae3f057b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
c552d3fb9ffa64e774a0864c512fff76

SHA1
78f329ea1a159d56f694d7878c93b5e5faae17c3

SHA256
cec64230b83b47e567799f4e558f60ef0d8d9bc3a252185edaa175030044adea

SHA512
c8ecb6ced9fb170654236e550c864b1f7a9bf6531475baa1338aee0aac06d0f9be10fe0177967f47a74ce5e90711279e6fa0344f0367ac020338aeecd8f22efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dc75.TMP

Filesize
705B

MD5
193ce659d0af24e357325be1b2919787

SHA1
62870820b79906b472b9372b7a9f7730bf05251b

SHA256
6a811c9b0f845c905a8485903b557f290ab98cfa0cd7b70fc437ccc87510b7b3

SHA512
25211b3189cce2ed6a6591835913189081134e32c6056eb74bd2b3236c0e076f70d9c454b165f41b5a17a9c8abe5b7a95c9156a9e19023654b5624afeaa5a623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7fbc1a90ae6b4fa46e2a27ace7e74bc

SHA1
85fdc9511a8c80a0615df03761ad62e984cf7bd5

SHA256
05b5083942c503df76a93a66f619f1f8c9fbaf3bca228685d017a4f9ad6b954a

SHA512
0f249ddd4bf5730fdbaf8af8dc5c06e4f0fdd0125e6b1d761b4239b883f2ef3e9d96df6262758bcce7063020b02c83d4f40f808ea0fada81b6eba18014671bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
56a6baaa04f044101d6eea00f010ee8d

SHA1
c339b0c847c5286416c0f7a854f5ae964ad76b45

SHA256
f82accebe7891d4dc72ed682347b7d67d739926a3c139d3378b0dfccc39a3872

SHA512
0aefaed8d802ecf690bbf8893313fb094fa9ad4c526ca9b9fffbc12ebdfd1d4c5cbb8feb5215544a6a0f9c5c7dcbe3e931c74af30d50f1fe51717e74307995f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit