541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe
Size

2.7MB
MD5

f1768e286265f23412cc05f86ac56704
SHA1

ff3b4bccaa8f98fe0886e85a47f3ece0128e1bf7
SHA256

541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230
SHA512

1aea68259cc032b0725c0f85fe724a24c954e3706938756c098d49fa4a2efc81e6d93a6d36e5af0338552c0fc91cd1e7140561b4b57a90dc407f44526441060c
SSDEEP

49152:oCiYPoLY0I7LQvIlD9QIAN8rdU2COL+NmI:diYALY04LQvI5SuC+VI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1804-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral2/memory/1804-1-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral2/memory/1804-5-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-4-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-6-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-7-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-9-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-11-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-13-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-16-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-18-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-20-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-22-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-24-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-26-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral2/memory/1804-27-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-29-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-31-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-33-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-35-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-37-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-39-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-41-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-43-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-45-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-47-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-49-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx
behavioral2/memory/1804-50-0x00000000025B0000-0x00000000025EE000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4988	msedge.exe
4988	msedge.exe
932	identity_helper.exe
932	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1804	541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe
1804	541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe
1804	541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe
1804	541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4988	1804	541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe	95
PID 1804 wrote to memory of 4988	1804	541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe	95
PID 4988 wrote to memory of 4852	4988	msedge.exe	96
PID 4988 wrote to memory of 4852	4988	msedge.exe	96
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 2916	4988	msedge.exe	99
PID 4988 wrote to memory of 4872	4988	msedge.exe	98
PID 4988 wrote to memory of 4872	4988	msedge.exe	98
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100
PID 4988 wrote to memory of 5020	4988	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe
"C:\Users\Admin\AppData\Local\Temp\541e0fd8d241290a7bfb114e4230db7005fd4236e66bb2cb31e8bd3d7ae3a230.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.4399fx.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5cbd46f8,0x7ffa5cbd4708,0x7ffa5cbd4718
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1186048842066282074,8493841440467794629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
bdfbf72d1cad277295ec15b723e092a3

SHA1
b82bc57b536edd40a0c0a849b12c953a4d5eab2e

SHA256
b95856867e7db20f48181a5363a85815b3fa292dec202aecd00d465eaa1f1aec

SHA512
5d1ac522802bcdb6e95856c8ee0b3d3140ed01cc5406bd53c02547cba9c35b338077d176dc2b5101df238909218c62edd5e935cb31c6c7f69943cd6082809be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d59110164e7890b78f89fc0f77cb2a7

SHA1
644bfa219af28b34ddabf4f7267530e3a5edc0fe

SHA256
e58fd14624992f19840def988ac2edc2decca07bbd665e4b103bdc2d9c8fa0f8

SHA512
ae512f630d1ebc5f78bfb6d9dde18192aa68dbb955d691dc20c91d8002847235234b64a0876f997cd7e35a3b7d913e1c37a197a26d19d76f9ba9118d626a77fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a866fe4db006dce259b69e663926a44a

SHA1
fd4fb700f5cc542a1eec021bb50a2a59f52f9357

SHA256
91f8604a2b4ad80ae73c7dcab1b26d59ebc82abd3d9cac32e0cbba0f98e1ed6a

SHA512
1a3ae45238fc807d3051685cfd311a1ddd8b80a210b042a1d25d731b959c5e1750f641a03b4d1ad4ec320a9f80d35c197bab3ab8032aac4fbbab07aa2bd7ab7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f48c7413d2877df7392d81f69aad0fa

SHA1
22ac958123c89839ab610198e2fff7c2f438a539

SHA256
d3f04bb4471218e74167b86926b202d4298160116b39350b1a95a40b194b8154

SHA512
550efdef687f445e61e8bb04af0e71596deda6f75fe2377595ea8b6fbbf84d9443a0d21a1db5820f8633db0974ace7dfbf3f453c3afaaebd85484faf9f97a833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
667d614786562cb23c875863a64ebfd4

SHA1
e072debb955eca351684359c5fa3d888c1d798e7

SHA256
90ba4f6027ce958e0845ed4935f16efb5ce91e4483067585b4d9f385593fd14e

SHA512
e6827ca2d14eeca58a0daa3d82bbf7e6d669514561054731e8067a78829c7380a3f2513f01c2ba7741ae41c64e4a8d63aa614b63cd4f757e74615c38b6812b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592cf2.TMP

Filesize
204B

MD5
cb0272ded07133f010037102c566c7d9

SHA1
2580303a646174c4714f1b6d4b45c77398ef7c44

SHA256
7c6c668d97413043ad696724fd9960abf3bebc9df2a88e1ff45771c0e2c0e8c5

SHA512
db0fba2b6d9a2537932ad2ebf6539d6494f313baed4d429da51222d5568855245ec2ccb43f894071c485e1d938980a39aa4278697c3fe2e05cb7aa7cd4069ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ea556bac429e348645ec4df6559aa31

SHA1
9714ebd9cdce2e91cd82c09f1cd66af0554d14a2

SHA256
8fa72aca47c2403ae03d1b0100a91bbe03a7a5d86a7d74856dabf6eba4ff960c

SHA512
302c334934a6b62194aafccb8775251dfb9e268450efa30931d3beba2c06cc5e803dd9212010dd3e99770156b51b458898db9c7c5c5dc1455b0b5fe918120a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c9a86fbdcd07bf1fbbb7e51ad10c340a

SHA1
23110a68b88930999e6f52aebe50ae49006e324c

SHA256
f07cc8ae544ff794feef558e3d37fbbe909fb40fa47b5004faa3a31903a8de48

SHA512
a252d25366b789a77c34eebde9d1ed860976c06a5ca4216b3c1bfe9fa680809f2abb41496b805b5df8771be4dc3dd120f7d4e1a91ada7d1dbefb96330a8f0e75

Download Submit
memory/1804-18-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-49-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-27-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-29-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-31-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-33-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-35-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-37-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-39-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-41-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-43-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-45-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-47-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-26-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1804-50-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-24-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-22-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-20-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1804-16-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-13-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-11-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-9-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-7-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-6-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-4-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-5-0x00000000025B0000-0x00000000025EE000-memory.dmp

Filesize
248KB

Download
memory/1804-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download