hxxp://www-de-ven1[.]dfsvenue[.]com

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www-de-ven1.dfsvenue.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3744	msedge.exe
3744	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1780	3744	msedge.exe	82
PID 3744 wrote to memory of 1780	3744	msedge.exe	82
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3700	3744	msedge.exe	83
PID 3744 wrote to memory of 3504	3744	msedge.exe	84
PID 3744 wrote to memory of 3504	3744	msedge.exe	84
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85
PID 3744 wrote to memory of 1424	3744	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://www-de-ven1.dfsvenue.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93d546f8,0x7ffb93d54708,0x7ffb93d54718
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2432592709329209198,13999915344138975503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1356 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
c1d8946eb3701b0f48fe21f35cf61b7e

SHA1
d5a110176c009f70e2bfa0a6b15feefdf875a290

SHA256
5c7069ca5eb1c86b7746d3f193b49e2b0d97376886ebe79e5fb9ee6052da3680

SHA512
a8914a159d7542efcef617337e9c0b315f418d3f3c581dc0cafc51b0187252daa2a5d98b429289a4468dd93efe8b393eb71c7a83f830224da28b86f6b283eb89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
3144b30a08a11f58760126b89f55f631

SHA1
2510b4075f57d1396bd35a5d5facca070a0b95b8

SHA256
4d79a1716b11edc28b1a5908127310a428d9694a483962bb8ed9b08f74a54b1b

SHA512
1755ab9007201d503ec79e3743fe0be1d1966845c5a2d13d37689a9e5bae7986caea89d5318dd90e2a3aeea8027979af71646673226b9017ea5377f353439c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
06558b62b8a43af2eb6332a1955aa4a9

SHA1
26df038e6ac3754804463bf79a64afb7749d6640

SHA256
14f97bc0ec508f8044ecf0c9559a700260a4e2cbf3dd546e3893936a8018c8e6

SHA512
2a4f3fbba97f830eb62299a4ddf4cfe3cc8c58038a5279e425d3b0d31e5ef6aff9dd1570b6a6b186fa41799d59f201daedeb3f97e628da2e895949e416977686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e847fc65e96093e84445bcdfbf1a71d

SHA1
0c2116d8a34334c9ef0f14f63c70772ebb5afd1f

SHA256
2ec83b08d498c7d88838a266253a299861ad2c34606275eeb8acb8454811a79f

SHA512
d8a4024bd9ccd747d40ff4c27302dc8573c3e12b1e8268848a5dd4c49da6170aa6e925d795efbca78473bb28427b14c31fe71051394dfe4788a575e4ca98d279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41d4a213d811d5cb4b83dd00f7fe9ae4

SHA1
b475045a28044705cd39ada5a3f06ff5eedca5e3

SHA256
3cfc98474b961bef82c0c139f44280d55eef745d5bd5425a6f10cc7e27bb2f8f

SHA512
81282b09226bb10110bcec810e8b579221c552e2a73df336b2f8d6ca3b2509958b3b9d6faef1ef105aa725c8206e105c52993bafb7fb674b442ff291a54b4c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
510ded801bc9ca12c0f7ec6774ee9619

SHA1
c4ec4157e473a1ac99fe47f372966afb117c9ff6

SHA256
ea82f313d38d5f6a1386b88836f1c1017fccc97142d3f15b1eaa12d3cdc36474

SHA512
e66be8d7dcc177886e9620ae51ad0109154ada9a96dc138284efcc2b6ae9bf7a706d3b2cbe74a856d04ed679667fc085ee70f65de3889ab783897b26a773f4d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0411a9556f13174c3589d54b6072134e

SHA1
5f915002d7b343db44c0423d314996c11c781b37

SHA256
a6fe43c9fd289b33ccd93ad73cdfa94c9f4331e2669664c42066db7b16cd97b4

SHA512
601619c79e75f4157ad6c59adf06ebc8d74e1f241f103f4b8cabcf7a3be2c4fcb6ce9558f188e8443109885a483ae1c00d4838ef7c775140193e66223dd70394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd59ffe3d55503f3f8325e6c8c8de9be

SHA1
9fc1bdd2665fe53ac84438f000c7f7a575d8f065

SHA256
38e3b0f3f155ad7ae99dc2853763594da42cfe52d827551ff1de84d117b59d5c

SHA512
f2fad59c1cd572104bf484366da35c311fdb2602dcdfc4d1ea8aa1dced52938a1b1da2b2417642f9320c58c37d13e6b06104edc224f29dcb1da08ad05700cf14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
baeaf8d8fe7ecc16325e4dd523ad0079

SHA1
a9738896ab5b9913ae48e3b886d678e7a7aff180

SHA256
70022214063fa7c48f52d78a31d5f2f1939dd11fcc269ff5764279166bd1a87d

SHA512
b663b708b32077aa64e7ffb436fe7517b365305b581698c7973fe8de68fcb9a2c709e487b0a5f4ca9557b9e1026f73ccd8c867b0c21ce648138fbab3b9989236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08eb54bd48d112f5d77b4eb08d7d36cc

SHA1
dbbaea47b31f553f1918280055fff39c1f42e16f

SHA256
c099cc386e7e88358a9c308740ab1c79b2e4e2a7a35eb51a665009acfd75c110

SHA512
8d76c306e2c448af10e872d5f12022b720acf9b8d122b250af98dcbe479cfceb0ee57c028f8af1fff3195981d4bbf67255237b8d46b501a06e74c36e2d88a45d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa8c.TMP

Filesize
1KB

MD5
de06f90999302d81664404497ca449f2

SHA1
19a55a762a4084356c2f82f514b053db471bc212

SHA256
9ae71d906806a90b7202e8cb23c1f57e91a60c8a81f1b88d75b8086eeb425a15

SHA512
5e9533f53330c952cfc2c023f0e89ef56bcb6c6630450cfb58a9dd7bf045fd57c06149883084be99fde633b119501e284cc43a2ac2c9780caa398a87490ba0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5987f03c3d84798a3b207ebe47608a77

SHA1
5a7c0af6475493c71abd3b731c86ca6e4a7080b6

SHA256
7cb840ca7a092ffa18034eed5c2426d8b47d9e8bdbadeed75b3870c68598e3b2

SHA512
74ed070ea394b04068d537b2cbfcd4a9cf7e4f5426f92ea3ebca53375f83b2953ee2c7739e42e6b7a3c7a776ce96f902b0b47fdd263bbb32276de0abb1767090

Download Submit