1070b4766e0979a8e15ddbd3d0ba27a9d05272027b3a20eaaf9c9fd854f2def7

Analysis

max time kernel
30s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Netflix Tools PACK/Netflix Tools PACK/Netflix GC Generator By SpaceXVIII/Gen/GC.exe
Size

302KB
MD5

b02bdf8aeb0e96e69b2107fbc96c3f1f
SHA1

90771870f1909f881130cc1f7a164707fcc0160a
SHA256

d7b2e25f499fbbe984af4dde8d05cca96d7deefddefc490b2bb44b84340f9835
SHA512

60788e68b91faeb24ad5df7c7467a03ef4be585738c962a166312e309ada79d0ef26c91938b2fd5515c7c9e1f06f34fb9d7ad0c80671817c3f989a179c8313ed
SSDEEP

3072:YwMfUEnWOkzE/JvsUwEWmpN1Hh3ueVj/GPE4GnnnVnfL4SLQEndIUuhgc2:iOE/dPh3vYwnV5M2dIUuU

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\bc857adf-f38a-4911-a977-b0b36b5f4336.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230623225830.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
4224	msedge.exe
4224	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4224	4380	GC.exe	80
PID 4380 wrote to memory of 4224	4380	GC.exe	80
PID 4224 wrote to memory of 4928	4224	msedge.exe	81
PID 4224 wrote to memory of 4928	4224	msedge.exe	81
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 2884	4224	msedge.exe	82
PID 4224 wrote to memory of 1560	4224	msedge.exe	83
PID 4224 wrote to memory of 1560	4224	msedge.exe	83
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84
PID 4224 wrote to memory of 3704	4224	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix GC Generator By SpaceXVIII\Gen\GC.exe
"C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix GC Generator By SpaceXVIII\Gen\GC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cracked.to/SpaceXVIII
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdad7846f8,0x7ffdad784708,0x7ffdad784718
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7ae5e5460,0x7ff7ae5e5470,0x7ff7ae5e5480
      4⤵
      PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3742604189501664572,12367309575954001783,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a9f76dde5876d055fc0a4a821de6d02

SHA1
3cb30f2ff875cff6a4e4be0c7506254e076ad4df

SHA256
323204c96cf3ed35bb893c2f20a444cd0c7aa0b44749174b7b22ab351b2edf1a

SHA512
b805309fbbc622f2e47c9d4397662713b37879d0ea0602675c0894e655b9dcd34d483a02c6bdb73b5c6ce084ca7523e038104bce428a5bc7be3569c0d18b9091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
dd4e21e35a19e7aacb6697fdb23db092

SHA1
d3353100527580b1fa646d1e7501aa18308797f6

SHA256
86ee350dbcf8332e97129f3e576409647e2cd098665d66f54a296a3895305002

SHA512
e156ffaee8c0c51a03ecdeff51b844af4f23c49c20d9ef98580b87b4c88dd1cc423715f16c9c155fcd5f2fbd8f4fb725ee14ceb264575ab2943b58bfe8b5d31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
173029b86aed17405a5340578d691b55

SHA1
28742af7301f93d45f0e7c994ba9a1cac2aa7387

SHA256
e1e40caa21b60d085685cbcc0cd67ca36de82a69ba3a74da17c9472236190fb0

SHA512
132ef460a878e220bff6ea2ef88b3c38e0ea54e11b36f5b0a98b344a7a55f876af61bc2de9cdf2e3f74124dec5a140a58ecd523a2e791ffa09aea81b11b35c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b021c8e6043b7870613007a5e152c3e

SHA1
914cfb90187958d67eb8875aba60b3b06605899d

SHA256
8a36ede68bb8a7b72976a8d3b3e1d937ad2a5273f6daf2272c8cd54e19e1c3d6

SHA512
729d30c08af35167d60fc28edbc864116357615aa60aa7be9ddd3e43fac7c1d701b060154db756b7877014a57e4dc132fb4f025dceb02358338a8a6a50f0f564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3922931a21a66290ecb769f2d79cc417

SHA1
d72bc5af3b2da078125ce71512249f67765624c3

SHA256
0eb33cdbc3b30f2dd68d3e4de912b61c6f29f3ddbf17b8e83948e9243763b8d4

SHA512
e4b1c22b64afa2120c2ae1385374747b04ea4b509fef1a27384755d57cfd4a86008cbf9af7095a1955c9934148b38cf7aa32b036d08702cbaa0ec9f5f59c3987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b359167b3568d1b4953adefdef0deb24

SHA1
98405d3ec52edeed62f8a42bfe766ecf395a95b6

SHA256
177289a899357233597b059fde47b7e54aba35ca95e2a2201fd8d3ca68273578

SHA512
28efc3e9bb0350c2229ffdfc0578c0ebc8276405849480c1762c75d616998f6ff654f7ffde3cf0676b62b583b5ec207e514040de1a809b465bb9e734e29c96b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
3ab5566f182aad6df9d49665e71036fb

SHA1
d03c31ce9211743e7e3a0dfb2585f642d01b1a57

SHA256
15f2ad8a040da2a43ecf2a4c14f364a2a0cf23a8c83d0322aa48de86402bcafb

SHA512
391c7a6aa51d7be1c9bccc8e5d7a4a5376404fda20351d94dd8db756b23d550a1be49cbd063daeb1987dbae2dc89b268d04b2d10f828b0a5744b9a00c9c4ca7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0e123655254f063f0b3c12ed15a12df6

SHA1
3c3caebf7c7894671668394425d73b670a50fdbd

SHA256
7ba2d6f360182f36dfddacc6263280d397b4dfc9c6716a40c3f5020dfbf63858

SHA512
8649e7ef4dc4e0bc6b320ac7b8025555a6cf37b6d1374a3601be89f8066ca60bae784642cdb1d448f00bd96c69098bb381c4d09871a609b499fa9b53abe9a332

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2e29b3bb890de386fb9c984d6b5d8ae2

SHA1
07ff20bec3b91057f54f610ad1d532ddc6f01047

SHA256
03db9e97c61c766e7346ef15cfd67a6232e7fd521b7b3d453c44e47af7f8a980

SHA512
4ac4ebc5d29f6f1c1ba982a2578fb178a94cc8b52d1735f3e61acc62a754550a6c86292a5395201c3da9929cd119a5093e38376b7d640f6b2e8dde4154543588

Download Submit
memory/4380-269-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/4380-134-0x00000000005D0000-0x0000000000622000-memory.dmp

Filesize
328KB

Download
memory/4380-137-0x0000000005290000-0x0000000005322000-memory.dmp

Filesize
584KB

Download
memory/4380-136-0x0000000004FB0000-0x0000000004FCC000-memory.dmp

Filesize
112KB

Download
memory/4380-135-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download