limerat | 6f2986644f574dc5ec1bbe4fb2ffa19d7b41fcb11aeaf7e027c83b9101882509

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New-Client.exe
Size

28KB
MD5

f5ad333d2e7649b81b4b8cd1128c9eae
SHA1

d3102802195c99af03cc591fd09b33ea471ac2ef
SHA256

6f2986644f574dc5ec1bbe4fb2ffa19d7b41fcb11aeaf7e027c83b9101882509
SHA512

547ae49a7a863fde1a0eee5ae2f8047278bbcc24fe0a8fe3a77058228aef00dbff8642e0ed7fad1bbc6a05b09f291165e30d95597849be85502ab535f9776140
SSDEEP

384:vB+Sbj6NKGnD6N9AHNkADqD0nxghOFU6vDKNrCeJE3WNgYF9SuUjjQXvwQro3lcb:JpGD6N9wNpOkaY45NrGuUj8XCHij

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
123
antivm
false
c2_url
https://pastebin.com/raw/JdpXGZCA
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7e8e5952-828c-4667-b70a-257f3870e43c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230320145912.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
4172	msedge.exe
4172	msedge.exe
2108	New-Client.exe
4892	msedge.exe
4892	msedge.exe
2108	New-Client.exe
2108	New-Client.exe
4848	identity_helper.exe
4848	identity_helper.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe
2108	New-Client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	New-Client.exe
Token: SeDebugPrivilege	2108	New-Client.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4892	2108	New-Client.exe	92
PID 2108 wrote to memory of 4892	2108	New-Client.exe	92
PID 4892 wrote to memory of 4492	4892	msedge.exe	93
PID 4892 wrote to memory of 4492	4892	msedge.exe	93
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 3884	4892	msedge.exe	94
PID 4892 wrote to memory of 4172	4892	msedge.exe	95
PID 4892 wrote to memory of 4172	4892	msedge.exe	95
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97
PID 4892 wrote to memory of 2128	4892	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\New-Client.exe
"C:\Users\Admin\AppData\Local\Temp\New-Client.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffba83146f8,0x7ffba8314708,0x7ffba8314718
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3016 /prefetch:8
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff72c395460,0x7ff72c395470,0x7ff72c395480
      4⤵
      PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9280651021941762979,13350617716086009994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:5240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
68e3bd104db6026bc1fe5e143b0f4f1f

SHA1
52f23cc97d72f8dfdf1a446f9fe95ced6c065a35

SHA256
dfc91badd83c6b70d8e960b17d1ae21dfe04ed9c22b35ea6ad3e8e03d79b6abb

SHA512
cd9cff07f5537a847948bf454de7936d5637b9aaf98be0520066e4690f7cc7812594ebcaec6681bb0bfc99c6e1144af712af69cd8bc30a4bc0720ade96f9cc64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
37ddb1e82e085b226e48d4d8c82b969e

SHA1
c4bdebe2c4396f3a6138f9158b0edc417d7e8c6f

SHA256
cd1f53d131cdc60fb70798cc4d6d9605bd5c2edb1674d0173169a2603bd37f27

SHA512
d5b0c9740944a700e53a3a19fd62b236e1c9be7e46de3d2bb2e90310e25ca59ed7f7bc31cfeda962db7576b8d0395cf76e6f55435f73a8db8cf195300cac46a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
636710f69cff2186082e17c773cf88eb

SHA1
bbf64c0409786e1fc4d3d5d38a28021828fc05c4

SHA256
539187b520f0d68834be20f502197fb85227faaa58f0f5ebca7695dfe85f9004

SHA512
d54cad3bf29ad76dc352b3791ad1d78b0532ab16d7daaa1dce087609e43d0df8f61dcb9dc68cab75ac81a4208568893ff6ff265274a21433783223d7a8556846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
732f5f2190b3bc97ee9394c4f1fecef3

SHA1
3122c6e1e93e40bd403166d6a0a97b767ce991ea

SHA256
c9eac984fe4713bc2863eebcd342c2f4fb1652350b496f7fc9ceae63e04c8c72

SHA512
5758a3e006826e61be044162273b5318770cce5502c0b983cedf51d463a09449c21fc069c3f5709effdbaf4d75ea011d6567cc9f260ef70cc1bfdc4e81624583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2c9b2567e371f284fa52234a2eada071

SHA1
420b90101c7c37ce5d4b985b5515fccf91b20333

SHA256
bd857c24f81c502b9d04eef09623c0865ebe8bb638b13342d6195282d6798842

SHA512
623694a54e03577dbe3c2e14f9ee735ae1802d4d952df5ef103087b1d463f3c8f1cb9f2b38963b76f7596c4e79b09fb1f6d56b13b235cf3886ea8937a188a8d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46b47ef04b895eea835b48ee909e8e51

SHA1
527d364ab1df782d998b6befa90cf647a4d4fd04

SHA256
786fdeab04d8a1f9dec05c02d3ece75d9fc49b1aa6a8bbec58b5ff6c23adfa29

SHA512
765bf25b4c6ee95ac8ac4c819a9b3ba69328a4782f016ef94b72cc20beb70eb909494595d1a431395a067ee7890bc91d6479c8b53fc178a7a6828838f956d8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
50133bec754bbff22b60d2328ec9d8a7

SHA1
98b0e460bcf5b01364377618689b976d139a28fd

SHA256
e5cba30220b91f012faafe9b90b10d192dfedce061f7d20a3f101bad46d4e5cb

SHA512
9b557e5328d4a0fa2b0aa45ec192f164b5e33fbe9fe35f601b0da3bd87b148504db9f98f35499d63b874cfe105a242f2d11c1b91ed982a08612aa8a37a8d8169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e896f873cd7e5a166af2a77cfb573ab6

SHA1
2b49e299aeb6a6218aa47510f14d84bcbe793fa9

SHA256
03e6a3eb115eccaa3e8e18cc8107066241b4633ce5ceae3689cab8ae54456bb8

SHA512
6cabffe6740d0936a218e6f8f20312cc71a09bf346a3e3fbf1bf7506c6036bcaa2cface50dec30154d5b334747cd3ab4a05e6eacc32e654723ee031b0e4b8611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
e99ebe10207e30e635ce2ff497641e76

SHA1
b7f4cb477475ba20ec7e8c69d2cf56a297f55741

SHA256
1ed395f45a3cdc61650df8e36d46113d71884a72a9913f2a8b13c4529f7ce6ee

SHA512
96d7db35c45a5a2d30978568452c2530688a8bbc0900245b339b5d498c250d78cf25bf7bfac7b4532ec7f026e49da98f7b79f7315708d073e361f0de7fbb9553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
5305b1263443203d1c861548b11d6735

SHA1
9db66692377ce29fb05f3d042a87ffdcceba46ba

SHA256
71ce59a82c00bae8ae83b5fa1c986c434b628f5d638e76a4cc03207124ddca6b

SHA512
e142aa2e8c8dd84061239b9490d9cf08c7dc493a70b3deb5ce3859af0320c362b6c2a5f2fd747212558713a0329c6c220cbb86a440803babca41f37cefd2f017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579376.TMP

Filesize
372B

MD5
7136d37dee2ee950427cd3ef5f341da1

SHA1
cc17cdfd241e3383798bc674cbf95f4341f060db

SHA256
d32f53c2d6651a03fef75070f48c25e1ce73d4db0b87e9959f2e7a23a81cacca

SHA512
ce11f920eb6bb1b24a03b8606ad5d4f861b311c08927dacc21f7f758545959cec7c29d5fd03e72164a6ac2b12e90d1a8ae64c8f9c14677501bdaf5570fbdcca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f53d98120b5dc1a2b8a9aa569251a8b

SHA1
27ad1bd46825b9013a50ba515ef3d2a88390c4b8

SHA256
36eb5211411aea26e8f591d4c88dee631e5bc4ebff7bc2f72546e4f6d5bd2a7c

SHA512
5dae334f3a44f209e9b26446d0fe658c50103ea54b6defc1a128149f0e5b8bdcd547e4d728081271c28cb71dc78d26491d0f49f4df5ecf0d4a14466b4b4c8368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2bfa43d1a77168f8f8befa239b6efab3

SHA1
e3c17b4e0c5d617fd7c5c7f1af2873770642e2fa

SHA256
ae67e37d0503b5238eb3c1189bab98bbab1ead252918531cd3c82dfb2681acf3

SHA512
3ef07f14d2e0f5532242db3d73f2dadd69ad2a1f2ff9a4bcba241b9248d95891072b168b5371f2691d9045db0abb29093d1381d7f445be7ac40b3647ebe1598a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
058fde31864e6b3775b1b9245c6120d3

SHA1
f8dd81b3a231356c63b3b14e3cfcedb72040616b

SHA256
a2b2f4a36f57554b5546a2f25c9574f892c03e7d8e8b6daef8b86a075e0612ef

SHA512
009e634a2d98360bda69b9b5c5d3eca8d6ad5623f40f52f2a41c627d0411087ef69859bd35387d765af227d6b25283977c114eb069f2be4d112c5de3438202ca

Download Submit
memory/2108-135-0x0000000004CF0000-0x0000000004D56000-memory.dmp

Filesize
408KB

Download
memory/2108-133-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/2108-134-0x0000000004BB0000-0x0000000004C4C000-memory.dmp

Filesize
624KB

Download
memory/2108-139-0x0000000006F40000-0x0000000006FD2000-memory.dmp

Filesize
584KB

Download
memory/2108-138-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2108-137-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/2108-136-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download