a688b2d41603d258a079c14e3f4c76f4765ef5a548b7cd9c176c18447a43e255

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2023 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30eb8a16c5638c002278e18080651dd6e4bb5861557b8efd090c901dd76c2d47
Size

74KB
MD5

9b00d195cf4c807c25455e109d422add
SHA1

8a72402f9ae2bf6785b0a887a1d2589c7adb087a
SHA256

a688b2d41603d258a079c14e3f4c76f4765ef5a548b7cd9c176c18447a43e255
SHA512

e1a2eacb3930f9d424eefb65288b6e81fa0b7fe20b6523e244d29c47b5502bb2a3794e6fc0e049b386fa0c58c0f35a29eedd1dc8c189615b30c5aeda3a8cc758
SSDEEP

1536:kuGUzMs5nHUp+hY9JH4GSrwf7nbLPnBs+WoqFM88mrj:Zd50ccSrwf7nbLPnB8tFhj

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2416	1252	DW20.EXE	98

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1252	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1252	WINWORD.EXE
1252	WINWORD.EXE
1252	WINWORD.EXE
1252	WINWORD.EXE
4800	msedge.exe
4800	msedge.exe
3856	msedge.exe
3856	msedge.exe
5272	identity_helper.exe
5272	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	448	svchost.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1252	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE
2984	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2416	1252	WINWORD.EXE	100
PID 1252 wrote to memory of 2416	1252	WINWORD.EXE	100
PID 2416 wrote to memory of 4092	2416	DW20.EXE	101
PID 2416 wrote to memory of 4092	2416	DW20.EXE	101
PID 3856 wrote to memory of 3268	3856	msedge.exe	131
PID 3856 wrote to memory of 3268	3856	msedge.exe	131
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4720	3856	msedge.exe	133
PID 3856 wrote to memory of 4800	3856	msedge.exe	132
PID 3856 wrote to memory of 4800	3856	msedge.exe	132
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134
PID 3856 wrote to memory of 3968	3856	msedge.exe	134

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\30eb8a16c5638c002278e18080651dd6e4bb5861557b8efd090c901dd76c2d47
1⤵
PID:3968

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Desktop\FindBackup.dotx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 2320
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 2320
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3300

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Recently.docx" /o ""
1⤵
PID:1672

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2984

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://$temp/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff38e46f8,0x7ffff38e4708,0x7ffff38e4718
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13543931749741790319,3443488066816090221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
9963d0a13f4f83f409c56c7ca5a42db6

SHA1
c03a199ac1e8d57cb2583609b23c89f54fd9d2e4

SHA256
b4e1fea0b1ba71768a8291964a5e9dbb71712bb4ec9be888b289472d6ea53787

SHA512
dfa04d46e94be42e595cc6aec629ade91239a79eea310b2c56a420bdd39cacffacbb3e07347b44055451a36e0fe26ff37a07926795e79a1216c6b546257b07be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
416B

MD5
ef251c90943502a8de0a73419683fd1e

SHA1
24e6a5ae233d1fe1ed1ae637c6ae65653bd9dbef

SHA256
0e9510d1c5a29cde8ba20ffbb7b89f5a02c15187b046fcb78961f1c4984089b7

SHA512
539b646210e6d4f503200a6ae599856993178cb6eea89905c5a6c053ab873e8331a322b1b3201e0427c31b1db0d11e361d1c766f384e2014db094286358d64ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd4f285a6fe9e081797f381749f4cec0

SHA1
1b7961590820141dca85c820beb2b5844c6038d4

SHA256
78de496b46c9b499e92ed2adde2de2bcf372758243918c2c8abdd9404514ab95

SHA512
8764714323e819427f9e4fb11c7bb8b14238935751d5ebf4c03f09f502c2d4f1fdb55a622fd94189d153615860a0e9de813aee7b1847d3b4dbcfbe9d3c630361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc1f3f5d0db3a2965287d8b26a59315b

SHA1
0f0f6e1afb16aed068b691236132ca152edb1124

SHA256
15e504b86360b2aeb68f8b6514809651aecb74b86ca23b49cb202fd595eabfa8

SHA512
256e6ef0d416561c6542f0c936f787115a4f469b85215942ef7fae6243bfb909ca166b59c711590d577b4e1dbdabe907c731670cda832c7a765ff10f2b648004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ea3eb562ae6832a2bf0785ceadcfec6b

SHA1
a55773b14d3350c6fdf9075dda3cba0f8d038247

SHA256
e27b73ea096a878a86c216f6903a35b06353f68379f9c9d000d9a32fe0d4def6

SHA512
a98bc0f24e22535bf59dee45e7aefbccd24ef9ee4bb9c866cb29653bda9bfe714405dabef18260b3209cd542f714df6e04c2d39478b0d22e98019a52b08b1649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0bb057264aabcdf677dc7c8125786195

SHA1
fd65f3212f46b288a5843f5d0297a54ad1ff5cd2

SHA256
08f8a50167657096cf22beebb36dad20ac6f76f7120768762b6eac807894a3ac

SHA512
7c760cd52eeecb0a611bc70e229cfb32a6d9abba13feafa3f596ab8413c5dcd70396cce4ba8a82343312f7beb65107badf551db932adacab2ffb24b6d9c80b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
202B

MD5
add56ec49f8f478e84a934606effef1c

SHA1
1262ae87ef755e40752740df90d21352d5fc81ec

SHA256
22e509cf2b7202fc6b04c3d9a1b137477f11471d58a48c1f9514f89450217327

SHA512
c095f193d221696f3b087c3f224a559ad0efe4852a5392c8a3ab03f80183beec2a8327892aa481c85f1bf8165b76a029555f250e0dd5f396c823feacff4c06f1

Download Submit
memory/448-133-0x0000023433B40000-0x0000023433B50000-memory.dmp

Filesize
64KB

Download
memory/448-117-0x0000023433A40000-0x0000023433A50000-memory.dmp

Filesize
64KB

Download
memory/1252-12-0x00007FF7D9470000-0x00007FF7D9480000-memory.dmp

Filesize
64KB

Download
memory/1252-15-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-16-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-17-0x00007FF7D9470000-0x00007FF7D9480000-memory.dmp

Filesize
64KB

Download
memory/1252-14-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-13-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-1-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-11-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-10-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-9-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-3-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1252-7-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1252-8-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1252-5-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1252-6-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-4-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-2-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-42-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1252-0-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1672-43-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1672-53-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-47-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-49-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-50-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1672-51-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-52-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1672-46-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1672-48-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/1672-45-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-54-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-55-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-56-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-58-0x00007FF7D9470000-0x00007FF7D9480000-memory.dmp

Filesize
64KB

Download
memory/1672-59-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-60-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-61-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-57-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-44-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/1672-90-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-22-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-40-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-19-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-24-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-26-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-27-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-28-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-35-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2416-36-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2416-38-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2416-37-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2416-39-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2416-41-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-68-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-111-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2984-116-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-66-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-115-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-113-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2984-112-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2984-114-0x00007FF7DBCF0000-0x00007FF7DBD00000-memory.dmp

Filesize
64KB

Download
memory/2984-65-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-70-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-77-0x00007FF7D9470000-0x00007FF7D9480000-memory.dmp

Filesize
64KB

Download
memory/2984-76-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-74-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-73-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-72-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download
memory/2984-71-0x00007FF81BC70000-0x00007FF81BE65000-memory.dmp

Filesize
2.0MB

Download