33ee4bddd3c96819543221b4ecc7a52f3030890551d2894191cec3344b5d45e4

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fatura.xlsx
Size

51KB
MD5

9677c0bea1dc80647dc75522a28a5371
SHA1

2047db0561d479320ad7dc74b543f49ae2b82259
SHA256

33ee4bddd3c96819543221b4ecc7a52f3030890551d2894191cec3344b5d45e4
SHA512

b65897dfd61d158cabe9f925510ce45ed4ac492ff8e5e04d227b9d74f35789c7377fac8c99a9d61c23115fbfc30f7772398aa862ac9e04aa77a12582072ca331
SSDEEP

768:mIgTcNBVbOxexMJE6PMMMMMMSUUfw0lWY5zWCF9FhjPp4UoJ4x9/:Mibysf6PMMMMMMv9Y5vF1jRdoJ89/

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1816	4772	msedge.exe	82

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\bdf9ab85-f0cd-4bb8-be37-8df5c147767b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230529132751.pma	setup.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4772	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
1816	msedge.exe
1816	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4772	EXCEL.EXE
4772	EXCEL.EXE
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE
4772	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1816	4772	EXCEL.EXE	91
PID 4772 wrote to memory of 1816	4772	EXCEL.EXE	91
PID 1816 wrote to memory of 2788	1816	msedge.exe	94
PID 1816 wrote to memory of 2788	1816	msedge.exe	94
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 3708	1816	msedge.exe	95
PID 1816 wrote to memory of 2088	1816	msedge.exe	96
PID 1816 wrote to memory of 2088	1816	msedge.exe	96
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98
PID 1816 wrote to memory of 3464	1816	msedge.exe	98

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Fatura.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://share-doc.app.box.com/embed/s/xrvi62n343y652exnk4pctf160519n26
  2⤵
  - Process spawned unexpected child process
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb941446f8,0x7ffb94144708,0x7ffb94144718
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 /prefetch:8
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0xec,0xe0,0x238,0xf4,0x7ff6937f5460,0x7ff6937f5470,0x7ff6937f5480
      4⤵
      PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7267809335533537212,13567497222549993800,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
    3⤵
    PID:5244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C

Filesize
779B

MD5
5d7a927bee225166a64d920036ff7fc5

SHA1
cd74e88ebb2e439913002627ff14411382ce9735

SHA256
7115cada884511368a1fddd3f641a3d029e5103f37cbc6c295b50156c916cb73

SHA512
d498e18ced58232acb1c98aead912cf351ce3a33072bee458a3464efa791a83a08f56a620beac59339a159014c5dc3bae25d5446c8f2104753e1ba84d892fbd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_237689A4974F1D18729D2A0A5FEC6ED4

Filesize
471B

MD5
446f3fbde693667e07f752403099cbba

SHA1
d8d8a713e8cf6d4b34a2ae9503c5709388fe979d

SHA256
486fd932aed98d5f3a66b8eeca7230ff64dc579bde426ee31e6aea9bb587bfb3

SHA512
3c69856649993f9d4abce46ad962958e4bc3fdded3d48f8e4792eac6569c8f5cc2c8516528a7de6fca937c78c1251c3351802e71ce524ba968c3056a9f46a1d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C

Filesize
246B

MD5
005fe98b759311d09d4b94e3212303ce

SHA1
c009df21f78bb000812e6db18d330d9660cc2e1c

SHA256
12eb9fee502731d75d11a687969ad984d95dc5b5b92aa2a31a43720692efb8f9

SHA512
2d0ab590b736708854cf03d5b22205a934f9825f3f49718ab25a8e83e506b0537ed5200623c36a373627550c927751d29d581bb790552db181383ed04ebeb192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_237689A4974F1D18729D2A0A5FEC6ED4

Filesize
400B

MD5
736dbd9616f1c47fb1e169dd944033b5

SHA1
d162b3354b8813d3b424cb0e09844503cd545f5a

SHA256
8d7eb39522b75192011845c1e9d250b2992e84f28be691f547f7263db10190a1

SHA512
5dc27e439171dea918e9a1987e8098af68273689af8dd22c99e2f298bfc378e3d61495c0e6301a1b11e46f3ac02454e57a36d8256b00474a43863bc8bef058e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4a9adcba6b392d3590e96bde65e7b2b3

SHA1
1b2059b86ab85c926aea5290a5e87fc8ed78a846

SHA256
68c0994915fbba6b012b2821769eaa6123afb8dee4ba82d8ea92abc9bf78b6cb

SHA512
b42ccbe59f9ff3ea7ba4c8c4c6a624ad96bf2c45b61b56534720d6ec7437a0312bb73df6b4b18e7b5e53190650401417dfdaf0f91e87599cb6a2598aeb0a605e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
4bcf2cab642fed07884752347dd315b1

SHA1
9ab19e2f0d39881c45ecfb47857540c2586d5e2c

SHA256
cc42db051a9d96d1d11ea7fffd4315bbb9aa3ff9bf1640264e6abd466acf1ebb

SHA512
a0d9ed7e688f8933bbbb5b6f290cb4fe2019f6eebb9833f1d439b9f07cb815152db1da254d8cb33c3ad0d265d8e69ab3329716fc3bc0ccb01f27665e6e1ac88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
54c53ab2a5533a81c0bbbaaddec0dbfe

SHA1
0a3772e1ea5a2843570673a89e2d34da1e694c79

SHA256
9662e1cccf7b22025c60c1957a52d67fd9a4b31ee2146a0dfda2ccbcf3a44053

SHA512
1c4066e2f26797fd2f2744f07b50e1784a99701b556a81b0c165ce4a20ed205742a4f96f2e0080d55aa4166c1450ca2a11dad473b94dc6317801633904ef5d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d41d4b54ea90bbd6e6212101c1d47292

SHA1
344353649c714fb0d6f2e642c013e61962030c5f

SHA256
118a54c1a20da4b395836306d46f0f8339342ffb9c07e793bada7e90eba20858

SHA512
26c732c6461900d114b03d5b8480cbe8701815c351f950d8051ab562357d35ecd0a0e53e9a8416868d83523b17ed4719f3e6f75d784b2e1a9a4fae507f4fe637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70fb6bc2f1be1aadeb2c6dab85cb7bde

SHA1
264a75ef0a73df90a8cfba8a9cf39314cd8bd437

SHA256
fb1a4a607cdee65764af3ed80131ddd4785aa65877cf9f781b3a3671dd1c8458

SHA512
803efecf64cd72da50420ab554f57c9bc415e87535f60db1c16ab33071c317c1d7502ffe40a765b8ae9418bee54599f9499ae0e389035e371ef47bc395d3f4f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
1139a7f4775651c94d753ab7efa1f270

SHA1
d7c41283dc971825fa8c682b64c524f38aff9c8f

SHA256
cb5fe3732d7947d77eca050cb07df9e63b946fb396a9523cf365f4f3287029e1

SHA512
e4be428c0761c69341dc569f8d59ebeb9f16b6ae9e0c517eee371b4887f7ff1d7daaa008b03a654871190440b2cb40b8c78c7009343162d68e967018645cdc43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
617e1729d89236798a156b9f6473521f

SHA1
63a9c935a1eabaafcf3e543636ba2159d3524f71

SHA256
5a87289e77b3d26c3f7a36fc00f17b322f28f29245a6628ef02c7ffd84d58655

SHA512
468201798af422623aa36405c894adc279bf2be1e0843da4d01d289947deb44b2b9d7484f9c28f2d96fabf1f57771d64dace6ba010ca7e9154085ec85f146b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3d874cbf2372e29aa7bde5be5e1db4b3

SHA1
a9214d4e1ddfd7f4cbe8fc61f838f9f2a2f2f26f

SHA256
84c9c0c31f068bcdc2258102ef25547073b785cfedc7345f510de21dd6096000

SHA512
8f90c381382b2a95c3ba3fe941429cc70094c92e78668a54ac88ed3e030c14ee7c3ba8ee7f450533456fd1933663b4c300f265da972fc0493aa409cc17b9fe10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
876B

MD5
cf165c92127b95487349dace28d8b56f

SHA1
8feaa956821f448570c28bbd04142c9a49092b50

SHA256
c9a901b8ebd5630253ba3c9fe2e8a93dc67bea5b0aa570536994f3bd9f1a332f

SHA512
056b7bc832b47f5eda46e6cce35706262e1b97cfb333679c13ee2dc74c623375745e1ddaa57e770f4c1f5aa13efa732afddad93f0882f0e94918a255dfef1846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
876B

MD5
8e4c322e1a30cbe1a9f3a7bc0b446abb

SHA1
02ac9763777e9149273f6c801e5ce6dca91377db

SHA256
5d683dc3c34a251f39af8982f5c7d536a597d6bcf1ff61e911df6875831be788

SHA512
8ea15519dd66ad5f69edaabbc9815633333200c6645fe5a563c9bfff6214c6537a8e2b72314f4f36ed8c256188ad6d313e4930047b8b2f2c781f9ca879ad5c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe574352.TMP

Filesize
876B

MD5
77ecae89fabdf068890393501d20c53d

SHA1
ccea295b9fe39dd6065534de796d6ef7bf8b722a

SHA256
255e5b2d97477fe0f34407699314abb4e2a6198423a2f4fc1a68387946798062

SHA512
026eacf8d899b976dbc9c4f116c19e64514c91aae4bce9d851ab1a34e5e7ee2243a5d834737b2dfe73c3cac4f055bade47c7e5462a2423c3c9ee005025ccb5c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
408a46da9a20e6747b709cfe2fb4815d

SHA1
efb2f59a71e162d64694de9721f991ab86263f4b

SHA256
ba775ce5f33715dcd8eecb3ce4d280044224f3929c5e01df60674e4099064e06

SHA512
1bd6d0a9846750b89be14f0ea568f86bde4b2e66a3c48d9b6a8e7f18bb81d0da3a410cafa76c5ff7d261954add4c505c9f2d14c5c3252e84d5103e8fd3da0768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6272b5f7e9a5ac3a292f8606be23734e

SHA1
2532474085f92ccb62d283b544b6964cdbe137fb

SHA256
8f4a33e9f3f9b177afc030c4c727a86135b74316dba4bd7545353d6073f29fb6

SHA512
830ccd0926d6f646f25da1d79759427e24ea27d791be95407742c7471a4c809d84cd1a1c86dea069dce212fd10746eefdd01ba74f557216062e307e7a14d201b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e57d4d41d130f31813fcb2833d1488c5

SHA1
196bbe56a9758f51d34f46569370e20b843d981b

SHA256
5353758cacd9fc16fec540e0b12936bf9f56b832f4debdff650087374fc95bdd

SHA512
b8f1ff7cfe9e90c33a49d46dd6b5e3eb58c30dd7fc3dc90093fdfa039b6851a0a6be253e4461bbd842114cb2c10b2a8882f67cfc67179b56f1a4d8ed09059678

Download Submit
memory/4772-133-0x00007FFB7E0D0000-0x00007FFB7E0E0000-memory.dmp

Filesize
64KB

Download
memory/4772-139-0x00007FFB7B970000-0x00007FFB7B980000-memory.dmp

Filesize
64KB

Download
memory/4772-138-0x00007FFB7B970000-0x00007FFB7B980000-memory.dmp

Filesize
64KB

Download
memory/4772-137-0x00007FFB7E0D0000-0x00007FFB7E0E0000-memory.dmp

Filesize
64KB

Download
memory/4772-136-0x00007FFB7E0D0000-0x00007FFB7E0E0000-memory.dmp

Filesize
64KB

Download
memory/4772-134-0x00007FFB7E0D0000-0x00007FFB7E0E0000-memory.dmp

Filesize
64KB

Download
memory/4772-135-0x00007FFB7E0D0000-0x00007FFB7E0E0000-memory.dmp

Filesize
64KB

Download