hxxp://goo[.]su/youbpm

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2023 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://goo.su/youbpm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
4448	msedge.exe
4448	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5348	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3572	4448	msedge.exe	83
PID 4448 wrote to memory of 3572	4448	msedge.exe	83
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 2000	4448	msedge.exe	85
PID 4448 wrote to memory of 1660	4448	msedge.exe	84
PID 4448 wrote to memory of 1660	4448	msedge.exe	84
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86
PID 4448 wrote to memory of 2808	4448	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://goo.su/youbpm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd96fb46f8,0x7ffd96fb4708,0x7ffd96fb4718
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16856881025647614054,496194057730446769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
b94ba0203ddd3fc93be59c97f6a636ff

SHA1
ced418202811b5bc1582751aaf1e4dcef9c17c1e

SHA256
00a85e43e5f5ce6bc9e3315b9ba91991912f027280780eb16e7ec922d1c6982b

SHA512
ea2344feba459cdc8f91f9a1ec672df810b7e88afba99e554ebee0840ab09caf3d4105b74a5820ec84db9fddd84f7aac325946616a872560593c7cff2364a80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
e46200cfdd387fa7daa38cf9f366a263

SHA1
164b165f1f285384a14967b2e3d4be1abdbaa9dd

SHA256
b046cec197c19ee48f9b048f0d134d43246a61f63a6fb5fd79b1aaa4676da6cd

SHA512
7d9d135b4e453eb4ec74d67fd92b738ba6340e1d2890aac356abfca0d1aecf4014bbf6f50db0a0ac0025d7dee3276771eb4f9636380ea529bbbb38aab977f09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
1141d8ece1922ac011c943260fbb118a

SHA1
9079dc7f0030f1b415f8702b78e367a1ecc307da

SHA256
e9a645555a6fd55b05a61deceebb330e33d41b1f973ddb50339bf389a38f629a

SHA512
7cc2c398e272e740d301a3c2c298fa73d5ed87a158a38cb4356d55dcf358ea3d513bcaea13b0feb42fbf0b9f2fcd8a2e1e455bfb94247773ed01a1f824c7b5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\001\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fde4d9afd54ca1977ad34df0912ecfe9

SHA1
de571a7b3d1c916d4b9f2960bb7874fe090a4d06

SHA256
42099a5f47687a5e270d82b63c163a214d852b31108a5f5b6aefb2539a44c476

SHA512
891e5e26d879ee58256249195f96871d6cce807a8ea487c1d42c7860e2d1120938e3e50d8b2df150d012ac0eb714a32bc7d6cfd8409b29242827d0d166ab44b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
194bc5635bda2017d57b35e5f7f1f3b8

SHA1
8c78189faa644fa47a579cd22cc01d88d70ae4cb

SHA256
ca5ba8b3d89c7a93a9bddf8dfe384d6c075821fd4ff6dc74e65e08494fc3c4fc

SHA512
bfebc02956dd7746b4585fccd18134f8fdacea152c60c5353616f8ae537c69b093f0c1be5c0d0a20346b6af22524df8e79138250e40948dded44351f76a93b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbcea2821f7f0096b736f9841788346e

SHA1
a979a5a3eb9e7dd5ce1ac6767bcca2ec8adb1b56

SHA256
aabc2b6daed6af84a8cb7b904a78e4ff5141d7047494a9add98b23c549386623

SHA512
e8f397699f711433630a355f7b00bbd0a11b35a0908ef5a42f46ae59dc24e963068456ce72c01760e0cbdca85b47c5254083686efda4cd73e5d00f26aef474f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16e95102b5d1ac916f7ece6b604aef8f

SHA1
046e1a98f77ae52da040dddff01f1710ca6454c7

SHA256
9e2f6558aa09be87bf9de7df784599d8707681fd429d70bb52b016ca1fc53c23

SHA512
dd942ea9eb7df26e5519dcc9072ad472fbf544f84b017fb80509b1d58f9aa436dd0fec5bc5cd4dd217d5480ab716b699bc2da12b977ec682143b00e0dfaae878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
60e8885d32f8f17dba3f2228ab46a93e

SHA1
02a4aabf35e7a8ce325e66e873290ab5096cc150

SHA256
c4483c78310273d8cbe806bba9e6754231dc640549bc46cf87ff82e6fa4a5ca4

SHA512
a5ecaab7196decc41bb0518982c6c818563564de460b5fe12822a4f841280f184d02f4935f1230851e122864bc0fb16e410925933a9bfce4d216980cbdbb0969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fe1e1052a7e4dcec178471b30f9cb981

SHA1
4288df484c6e0a4e91237c3d87a045e028392184

SHA256
f4f61215d4ffbb752b0af13d658e981ecae00ca839c95408d73dc22096468b4d

SHA512
e010ef1dea6577e52a1437aa51862b3d6d9da2dd61c1b7b300488beede15cdf1f59d5e00037bdcc2e429ed05dcfa7fdba23aedd03141b067fbf6ee4cac6f508d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
12a1092ffe65985d0f2035d240867fc3

SHA1
e48ae06ff38d19073e7fafa5f9dbc8391c13dd72

SHA256
63e527768ad9871ac6ee017adf544da9b0744921f79eab0bf39b07af843b42e0

SHA512
c72035d9d839b6099e6ff1c1cd7a7c7d7693c35dbb8850435ae19e9171d93e87f5fd3f99a06efc4620579be91bc4a8937915333793ad898a136845553222f956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
377533cb5a9f94865628d0cac48cf6f3

SHA1
96607c6951badb4084e6166a26717d764fbf097a

SHA256
2bd6bb3a461ae792975a76abe5fc247b221a54943fe945494ad54e8f14bff100

SHA512
d929bf56d03fb890bbfe25891fe78e062d07f7ba4a3e13b71015db4127d68066e70686624c1d295df11ad27476bd047d3bc1d7eab8e136c6a99acfa3dd4ff4c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c7eb04880ce61a1c77390240fb5ad28

SHA1
45ce75322bce1d64d3fefa7bb005ef635018927b

SHA256
662f48ae3e6f3e91797075309f1fa30bbf63b43d6b1c4f8b3561e4ec1184bad3

SHA512
92f2b53840af14083bf3127f240f580d6673c6d2fa763ba1c97c40a05ef01b2f7f184b3127824655bf16ad67c6211b47de6a08d6594bb48955be70cc66bbb940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73b387126c4e1b035855cb81d9558600

SHA1
46df57c1f4c91b2d11a11554e03da566ded758f2

SHA256
ee350f9c5ee1daf1cceddf934391c1892c27b7722fd7ee28949c385041af6768

SHA512
9ce78d05c5e36a88d697d6ad12226aabad5fc82b0ad80c8ab686157135930bbce8400f0c3357142e6c73d1aa6f30e6d320627002bfdfe50bbe8cfa3105c7470f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9093ad6acb168c161ee2fda742c827f0

SHA1
c0f8ed16b23ec8010a7ba8a602c544f86b5a06c6

SHA256
478173fd04e5940bc69e24008293f656207993f01793a883c99142276d8259c8

SHA512
e3fc7f0f4d2855daf24d96f8a5470fda907775284638db226abb74e70962886549a243181f597ded40044af1c33989665584cfebe6e899221cb38ef897c14280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5e48a82ce1f51210b142ded4a95a8e53

SHA1
9561b74cdebae411825983ec5cfea77290717c12

SHA256
c4ba9a8b8beb16d3687de72f335767c2311dc722bf1e02f43c8f37501e9e8afe

SHA512
77321594b1eb50269fd2f84c714d5bf0962e3e530b08fc96c2c2cdb38ce26182bbc2c1e6596296be0dacd015b27e923853f3fb03fa96ca7007448ca48852f4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
81c69cc6b26a784c1612a633315b0b7f

SHA1
23a27f9d6218cf67a2d3ba13e698afeed0ae2d3d

SHA256
f4679584c131ba9f5715dea4daacedd452506d281c638ceb9b78fa9beb72f6e1

SHA512
4a17811781aeb1484ea760d064e682e2e02a813aed15965fd2483f1f2a0b3cb73d0f91405b8c98f1f50d038de0a12c2eb0276796be9b6146fa6584aec18e4e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
169a5960927322f094d5074637412d29

SHA1
bf4f932961f8092c73f1087af6ffbd1a84a8c894

SHA256
d4bf311ab3e9973367d48654e4667c10f76ae4b7f47c0c1a62d7aa3769fc8070

SHA512
9049397b5c9acfa299a8db0acb7a065db8a70a410bf9496de06d8c00abd3b3d52bf44cdf42b1a5b382fc8817dc660d444bd4b7b4a90ba1018dd1c0abf67fd0e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13203d861dd27368ec5911569a63092c

SHA1
7ba8629c790fd63a4d64d9c78d0c6de169e59209

SHA256
41b57c4b0e5e3476091fee5e721bf917112eb4c60a49f3c7e1d2537ceef83543

SHA512
ae6098ac66ce8297c70007c3ec749ca8a2393d42ea57944be0f2277296af682ec5e82f058dcc8e6066f716354a58f0e3a3970768a26c6b5a62695af31f5a6905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5847d2.TMP

Filesize
1KB

MD5
0471e92abfd5715376138b7abcdd603a

SHA1
b10992367e235d25e5042d09942a207f76eefa85

SHA256
fa7f45bfa8dade05d3e87a2105f6ae8d51376eca9179959bec4ba76548a20397

SHA512
8447117e1b6f19959a7d0dfa7f46d47ea76884bf46469d2921e62dc6fa8cc54ef3a1f073026b5357995979c9fffb87166711446d067a1adba039d31520b6230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9e1dc2a3a38700c252c13d96ebb5511

SHA1
dd56969229deb4cb820547c9f3ff8211249408c5

SHA256
06b6daf7ff38336803e0bcbff470eb084d5f49177d4e4a53a0b949452c998ef2

SHA512
9cf44dbafcf2a8674acbad7e518214b4968c90ee89847337923effd71c6554de5bfb7ab29daa8e852fafbc5442217e05efbb907ce0b605c37fdfb3ec59a5b92e

Download Submit
memory/5348-299-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-330-0x0000023F74670000-0x0000023F74671000-memory.dmp

Filesize
4KB

Download
memory/5348-305-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-306-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-307-0x0000023F74530000-0x0000023F74531000-memory.dmp

Filesize
4KB

Download
memory/5348-308-0x0000023F74520000-0x0000023F74521000-memory.dmp

Filesize
4KB

Download
memory/5348-310-0x0000023F74530000-0x0000023F74531000-memory.dmp

Filesize
4KB

Download
memory/5348-313-0x0000023F74520000-0x0000023F74521000-memory.dmp

Filesize
4KB

Download
memory/5348-316-0x0000023F74460000-0x0000023F74461000-memory.dmp

Filesize
4KB

Download
memory/5348-300-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-328-0x0000023F74660000-0x0000023F74661000-memory.dmp

Filesize
4KB

Download
memory/5348-304-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-331-0x0000023F74670000-0x0000023F74671000-memory.dmp

Filesize
4KB

Download
memory/5348-332-0x0000023F74780000-0x0000023F74781000-memory.dmp

Filesize
4KB

Download
memory/5348-298-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-297-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-296-0x0000023F748E0000-0x0000023F748E1000-memory.dmp

Filesize
4KB

Download
memory/5348-280-0x0000023F6C340000-0x0000023F6C350000-memory.dmp

Filesize
64KB

Download
memory/5348-264-0x0000023F6C240000-0x0000023F6C250000-memory.dmp

Filesize
64KB

Download
memory/5348-303-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-302-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download
memory/5348-301-0x0000023F74900000-0x0000023F74901000-memory.dmp

Filesize
4KB

Download