6a52cbe5d8ce6e5c6fe3b98251c6dd72b6c520fd0f8e77c57a553cf1a9d284d6

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe
Size

420KB
MD5

a8097e3dcb25de64dd34b54e7e1d907e
SHA1

40f69279931b2e3dc6d6f15afb791f5b6a999df7
SHA256

853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab
SHA512

e995829fae4dc2d00748e3b0cfaa4d2468bdaaaf19eab6f5c53843570e827357c9371b69418b2604d98312b9ad941395a16a6a4aad81ef20e831a851c7eb958f
SSDEEP

6144:3IvuN1+UhWWRjxEqFGxljQsO4CFvg3XY/6KP1RPdU7tuY2:3IvunWWRtEJZCFvfP1RPdURg

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
1868	msedge.exe
1868	msedge.exe
4228	identity_helper.exe
4228	identity_helper.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 1868	2808	853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe	96
PID 2808 wrote to memory of 1868	2808	853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe	96
PID 1868 wrote to memory of 860	1868	msedge.exe	97
PID 1868 wrote to memory of 860	1868	msedge.exe	97
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 4876	1868	msedge.exe	100
PID 1868 wrote to memory of 2524	1868	msedge.exe	99
PID 1868 wrote to memory of 2524	1868	msedge.exe	99
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98
PID 1868 wrote to memory of 4108	1868	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe
"C:\Users\Admin\AppData\Local\Temp\853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b0e646f8,0x7ff9b0e64708,0x7ff9b0e64718
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17412242136448296824,11486518499138335256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=853dccaacd1707bf42970f0317425690b1e00c30b44ac4d9dd2d47c7c926d8ab.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b0e646f8,0x7ff9b0e64708,0x7ff9b0e64718
    3⤵
    PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e1e23ab6fe26215fe0200c31518db508

SHA1
95385a14f34f041f6f717a2e3ec3c3364caac1a6

SHA256
48fc2a9833249d100be14a89a75b4a839c22fdb8bc904b9aad9ef46b15de9846

SHA512
c20a32eed5b7b7068e6d8a8ab4bbca2eba581664b1695162b531b5f423736f07df45434c6233d0fc106d343d8f3f21952c843a7dc5052c6387052e37dc5b469d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fdef58805e1e3da2f463bf10e9b0f01

SHA1
bf9183491ce9a83fd4f22a7e3cf60e7221edf184

SHA256
28ccb4321d7ad63e32b73564327e9d073f633d4754b52667f63320004052f603

SHA512
dbe53002993e5b7453d7573769c7d5d81ed336ffb334029a89bbe5ee9fde517d81287c411a7cca607a59edee0daf0bfd183fb617696de67c26c865db13f86032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4804b9fc73318d38cd0732e3d0e18004

SHA1
6ff63b826d4fd3f039abe10b7996067e4db91723

SHA256
7883fa02cf231803dd83baae5a245bec51b32e6c9027fed323937cde5ab68a8f

SHA512
228b7c009f1e4f4e637bc6a3f28637e74732332c1ff8206336dedfe71be6679c4a18162f8a8be2470bffaa3ff53cff575d1d933bc2b9c02a3fb4ebabc47ddab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
44b06380098461b23fbf2b19bbcd0804

SHA1
e561905cb16cd6d3d344a296a56bc0f783481cd8

SHA256
53717f536c3e56876010f35040cd45fc5a83ef24cb23cd54b86812e162a5a8ce

SHA512
4ca1d1691beff85d90864136a02bb69bf010b91a65da655b2e7c6495b45a24033a896400c4e32cf6345ec8e4da0f35c12a8cb5fd927bbbd5d6e5b745d31fbece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581d09.TMP

Filesize
371B

MD5
e328f7825bd9af7c2ad68778d841afa7

SHA1
99741dc7d8898064c8763abf174dc08db1c6ed77

SHA256
c2a19720f0db397ce27d02b435832a042ecd9c6d9d62007bd22f349c97322638

SHA512
f9fa0f48b32f6bfff000f91a8a3ff032908f3b95fcdce89e27acd27a82ba622b4866b27175b5028bb6f38621c405171d3cf1b420405085043e6906e5fd7edf70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47b7732660ca95432b524c369e44a598

SHA1
64ff92f80fb33488cafbc6ca42d60670d727903f

SHA256
cf533470b553cc121b815fd62c8a1df1b8f5bbd9b213d0438f3511dcee9ab5db

SHA512
06491c338a68b0419e73b2f0ecc1790fecaa21217c51caa75ffd79cbcf6900088303338cc15e449f3a76ff5af27a17215bfcbeac9e68a915991360cdd6e9c7f2

Download Submit
memory/2808-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2808-11-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2808-1-0x0000000000470000-0x00000000004C6000-memory.dmp

Filesize
344KB

Download