1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe
Size

468KB
MD5

34ae9714cd9115bade18d38426049c21
SHA1

e56b4f240f6f7ba2a8a42d5f9142003e1d30275d
SHA256

1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53
SHA512

167a0b09c1895306b3ec3b5136bb4454e3f19e4407f2c09ca05cce4f20a21a14c1c4e5eb476378dd5d828185a1b8523810f56835c9ecc47b56ba698fa9628e89
SSDEEP

12288:iBQbOtLTGqONXURCtrMQOR5qAO2XYZKs:Ly/OFNRMqAO8YZKs

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
1624	msedge.exe
1624	msedge.exe
2232	identity_helper.exe
2232	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3944	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 5084	3864	1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe	91
PID 3864 wrote to memory of 5084	3864	1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe	91
PID 3864 wrote to memory of 5084	3864	1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe	91
PID 5084 wrote to memory of 1624	5084	rundll32.exe	92
PID 5084 wrote to memory of 1624	5084	rundll32.exe	92
PID 1624 wrote to memory of 2076	1624	msedge.exe	93
PID 1624 wrote to memory of 2076	1624	msedge.exe	93
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 1928	1624	msedge.exe	94
PID 1624 wrote to memory of 760	1624	msedge.exe	95
PID 1624 wrote to memory of 760	1624	msedge.exe	95
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96
PID 1624 wrote to memory of 1036	1624	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe
"C:\Users\Admin\AppData\Local\Temp\1d0a36d115b958ed05ea67c96b324a275be60198786a2a56dc634f6502949a53.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler https://the-sz.com/products/flash/help.php#q=no%20adobe%20flash%20player%20installed
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://the-sz.com/products/flash/help.php#q=no%20adobe%20flash%20player%20installed
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd91d946f8,0x7ffd91d94708,0x7ffd91d94718
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,554263001619801282,4583072195337746557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
76a9d68ee77e1938b0e426ebdc8004ed

SHA1
fc1698cf67fe9c97b9e66d47ab46d242febcff28

SHA256
ab9eeea9e2dc2436aad61ff4a08f0adfc3ff4469ba8747c73adc8217608e7ea4

SHA512
98adf8b8c5394470a3bdd6f619424ed797d4733660889dccf5bead4f8e250058a7c95a2433061c3a9d7bdb38f5830617a4241506b286773e2f815a4432199d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
884505df2668b0f228da52efc3d82c40

SHA1
87fc87c20651ac69f9d2e72448d4c280ce35a2b4

SHA256
91eb3c8b1c672e0017f6f990ae63097b89b9a156d04a7d190ef203b870353320

SHA512
69138943e5d495da5d97e0aecd59e3dcd25b5e46e358fc22b29a344e933074a7d92ddefee26ef7a908a59160b687c0c05c32318cc7041c847e7189d4fbd292fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28287990842c297057c4b8a4513dbf5e

SHA1
9de0f57eb7480fad6782557aa846ab8576e460ec

SHA256
9773c127a2c2d1ed068b8ca729fab476b89156742cf11123d449c9da1f0cd940

SHA512
6420274ac0b82aeb60ab5945190991dd9dbe9fd774fe0823cae352520d5b5b35e7f9fe66ffce880829dfad07b7c69491634d78e4ca2dd785d743bf1fb3a8d8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8575722673509cad611c9d0ab06e965d

SHA1
8a00a09a8742d2404ae33a07180ee05da48065d1

SHA256
a6b9cfdd6d98bb915612524100075f0bea8c24221534a36123242aeb45c0a390

SHA512
b325c477c37ee0ec3758e8a5c2c3dae71eb5a99fb1981860064fbef9ac48bd8305ef97f9e88203a27ad350a8c6b9bab01fff22a1926cabb222069c4e4168dc5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d107c3f93d771e6cb07460f9c0733b22

SHA1
5b7018c674cdc313702af64304c00da5544f0db5

SHA256
4c722f3ec94969eae3cb42ac28609d3d3ec15f45825005da156be7d2502db6f3

SHA512
51230f858689d5c958b3c654424947a9dd15af93744d07ff219779ff7a8427a3555c4b6cc5d9cafc7a36146b715efb903c2204060e0eb2928a06b8e2cfee0434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0a025106ddc2fce8bb0daaf6eefeb408

SHA1
7ace8420bc05a4fd0ab498ea2b2ffb155589da71

SHA256
9e9913324fcc645014f40b97fed5cbc7974a6c95350ca7cac1cf8ccac3856d46

SHA512
1ac203daa14f3c168dfbb1a6b1e148fe111ab4fd8d13dfde009d0f124302f7e18d9c3efa5c641b2271ca2df3b0371455f65dfb36f1b4bd19c325c44a5bb1f586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c337d6fff0e7e154b33538282ede1a7

SHA1
e303fb056fd9cd2eef2048622eb2960c667d86d7

SHA256
afe2e2fa34d2598b056c4146e13552e2bead7b1cbb27dc2806ae68fac5657796

SHA512
6108b64d1e5609eeee75403d03f8a1c3d5158a908a77e6c79339cac368996ad8a014856c292a496c636841c1c0c6a22d9a24a48487afac102268a3f408245ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eafc.TMP

Filesize
1KB

MD5
e63a3e2126581bb3a27aefbb13a05602

SHA1
93ea2a4f903fd991f3c8918ab0b51ce8ada27d2a

SHA256
dc919a48c7ae76dce2d8acf3fbe378ec455f8a68c958759eeb1ef5857908a002

SHA512
b3ffe88648d73b50ce5c5595f45ee97397c7088c55d5e4ec9ffa5ffe880f54726c1ae5691bc2fc57b716beb7b3b07894aa7787b01bbe6ca8cbc102155f52b196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e78e756e4d30f70c9f71a0e8fdb711c

SHA1
97509888fd859c626ceb1ac0bc028750ca24e9d1

SHA256
1534888cae6f32fc41e4002db79664d22ee59aaf761447d89b5a83ec5c97383a

SHA512
6912fad603c2aba3ca6492ba960686279efdee3af3f78041969675dfc7c1beab8032cbebb705fa9e60cc869b402817b0a5d8be411318db8de85be52b73106ec2

Download Submit
memory/3864-2-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3864-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3864-1-0x0000000077420000-0x0000000077635000-memory.dmp

Filesize
2.1MB

Download
memory/3864-3-0x0000000077420000-0x0000000077635000-memory.dmp

Filesize
2.1MB

Download
memory/3944-253-0x00000195962A0000-0x00000195962B0000-memory.dmp

Filesize
64KB

Download
memory/3944-269-0x00000195963A0000-0x00000195963B0000-memory.dmp

Filesize
64KB

Download
memory/3944-285-0x000001959E710000-0x000001959E711000-memory.dmp

Filesize
4KB

Download
memory/3944-287-0x000001959E750000-0x000001959E751000-memory.dmp

Filesize
4KB

Download
memory/3944-288-0x000001959E740000-0x000001959E741000-memory.dmp

Filesize
4KB

Download
memory/3944-289-0x000001959E850000-0x000001959E851000-memory.dmp

Filesize
4KB

Download