6f298fa797a2a4726e370d6674b66d11c439792fbb4467744d0cd3fc329beefc

Resubmissions

27/11/2023, 00:06

231127-adzdksdb7s 6

27/11/2023, 00:02

231127-abv85sdb5v 6

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bpldr.exe
Size

392KB
MD5

760f9df773fff3a82e8c40db3ad96d3d
SHA1

cc6bb377f23f938c4336679678c3ee571f7c8d38
SHA256

6f298fa797a2a4726e370d6674b66d11c439792fbb4467744d0cd3fc329beefc
SHA512

a3d831e4aedcc6e7da5b0407927391f0c9c5d69e1e09ac9263ff116d8631f6a282bcd594593f2ced93055cbe841173becb74b973f18bb670d7a7ab4cb04f9870
SSDEEP

6144:p80ryMQxI3Gt/HY2ENyJHb3e5rjj411qUMAb/t4m3orWOggpAyO:p8oiCHNyNbO5zjAb/mmoymF

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
118	api.ipify.org
120	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3811856890-180006922-3689258494-1000\{4A7D2189-87F0-4171-9499-8DB6E54789B9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
3900	msedge.exe
3900	msedge.exe
1792	msedge.exe
1792	msedge.exe
2336	identity_helper.exe
2336	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	bpldr.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
2236	bpldr.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3900	2236	bpldr.exe	96
PID 2236 wrote to memory of 3900	2236	bpldr.exe	96
PID 3900 wrote to memory of 2480	3900	msedge.exe	97
PID 3900 wrote to memory of 2480	3900	msedge.exe	97
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 3740	3900	msedge.exe	99
PID 3900 wrote to memory of 4180	3900	msedge.exe	98
PID 3900 wrote to memory of 4180	3900	msedge.exe	98
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100
PID 3900 wrote to memory of 1560	3900	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\bpldr.exe
"C:\Users\Admin\AppData\Local\Temp\bpldr.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link-to.net/23425/936.244604613746/dynamic?r=aHR0cHM6Ly9jZG4uYmFzZXBsYXRlLndpbi8/az1lWUJ1TThiODloR0lSRElT
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafbb746f8,0x7ffafbb74708,0x7ffafbb74718
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4432 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16809225578170163830,8755079751974323713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
91KB

MD5
6b2f8ba4066f697fcf22c6f71c973b31

SHA1
75434eeabe5c5811d8d058d3f61508cf7d430c61

SHA256
de754b5e1b817fca499bd88b5ddf58924cbc3c1ff036510bf3df4a9d41216645

SHA512
7b8d4d0812590c51fda128f1a72fddf24f7d1805facdc8370049edc79b222dc0866736fe2c460ada86cde97c1bf43f452c5e1aa7c67def35fac45f9ddc99b9de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6d3ec5cda780dd36ea790453679cc86d

SHA1
f30d8252eeb485b358f3d2ecab01c53db35df8ab

SHA256
5589f18d42a71d75c1de47410028ac1f229968c0f63a2b50cd80e721bb545d67

SHA512
5612013fce3c4a37a562046161ffa0240e3b2c6ac83516e5dd90b2d51a0a7c4e7c5b4bd0adf816bad0a4974b9814ad385c9620051cdba1f348e459e9aea0b542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3951c8e4d6135d416d8c74aeb82a2550

SHA1
d018afd9e0964b326f0d7860fb5f5f5cbb97cefb

SHA256
93b2c76641f8c9c631df21e5163f3abf1b4764f5fe006208ad93e03192fe2849

SHA512
f2e9140786010e3687ec006937c8f141b7ca010f58363c0a9bb51040b76289e26a34f6ea76254bb47e9462c6293a68b54fffe77b8bfe3fd84ab398782ae8a49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
74d6b01e3619762bd6ce7e529ec84db4

SHA1
9137d02186657b62eb338e3c1e9221280d9803c9

SHA256
8ccd65d74ac7d1fcfa0e6693d370de925e2eb93a1ed7a89b346ec22e0d2b622e

SHA512
7c05d0134f38fdafd702a9eabe0b22e820da8244bb0a05c0d33f74530273d822d379a844f4f0c2656de7dd5821180dd327c2f47e32ad7da2da208a112d208b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b6f7a91101dd0e99ea1afc32170ff2e

SHA1
1ed94fe0440c108b99aec8c69b9b144785276a3b

SHA256
f42569bea99aa13b7905322c38beb70dbd19935078c0d637172fff19985b7e04

SHA512
2e00db5f9d78744335106072440f142c1143b441f112445394007e6d94989974e4ca4148fd1c7716fc17f888a0e0d42883d70fa7f6abae8a28b80366285bc016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
649eb91a154fb5dcdd93b1be91adb8db

SHA1
edb27145122eab6fc56d43283cbd102058fa55f7

SHA256
8cfc76027a04559c684dcd770e582da289c1861b12f6411c4ad7b405d4c37ef7

SHA512
b4eee8ed748fdcf960ed9a716c0b0c833437d3f0e5bf9b2b63fe132754592309b318f591a2f5dfb9ceb4c365e914ccb13f995dc35c173b441079cbc2d8d0fe3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8154e02efc2dbadc86ca3ad5fc51864b

SHA1
c8a6e77ea14de2250116e1938f76b399a65cda4c

SHA256
04d1a8f01ad5dc733f6ea3a56e96ba7f4db68d2f46c8aa2e0c0277dabfa493de

SHA512
0e59486b711260a6c993e6e163e559483649a58834b0c62371967c06f5297d647290fa3b671e6ad136c1f55cdb3e3191bc2e682a48a18b3ce09fadac17dcb92a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d6ff9ad962758c42787817de131f0933

SHA1
ae2a651e953d529b2faf6522913e37752fd551da

SHA256
2e7135ca241b4a6d1f00312886ce7939827d0bef0975355164838b6421f5c293

SHA512
19f652cdbb1a23f5cac7ccfba1c6c3f7e97fc80862a67da2a6b0c311f6e7d902984310aa2eff31b924a4cb29ef04a20e5bb96e5894bab7773605b585b1b43ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e990.TMP

Filesize
2KB

MD5
95b2eb406386e3a187d27c8083926aed

SHA1
91652b70238dd7ac2ec83bdb2bbf29d070574558

SHA256
ebe2245f3316182d608e597aaf3cacb5c4af7f30b626849c139895a18906cf84

SHA512
aba4948783ce457267bcccb677639a15020f28e010a77b6017a53d9d9665a4e5af2aa3052cbdf2abb431814856aa0c3a42943d047ec24535a87dd9f832cd8f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd136ece88d7c818452dc75ddf7d798e

SHA1
3389f6ee24d6feaa3238cdb6c7f250fc05c946b2

SHA256
87f5aeb5aa892fff77cd1fa3f8c489ebdad79f91c823ffd817166b92c25f9be3

SHA512
9c1228a181d45b043eec509ad47197a5b8503a7fd6dc76fff32c48b6554a7e0343b49fecfb59846b128471713e2a1e5c24c2679cd980f00587111cea8182d599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c70fb304b2b2cec4ae773f44cdb78bd2

SHA1
95912e15e3459a9c6042b7bf891e2ea1a13abb61

SHA256
76f49c0d13d882c7538253d4d40465b5de78d9d1db38a1201a849661a0ff2e30

SHA512
573936fa0b8e59d8cfd5141f8e3d4a10d14a11391e618b51b42da2b2fb83cc6be8e3d029977025cccca7b066dd81d0fda5ce3eab339dfb878d56fe2e2d78defd

Download Submit
memory/2236-4-0x00000000070C0000-0x0000000007152000-memory.dmp

Filesize
584KB

Download
memory/2236-7-0x0000000007490000-0x000000000749A000-memory.dmp

Filesize
40KB

Download
memory/2236-10-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/2236-5-0x0000000004550000-0x0000000004556000-memory.dmp

Filesize
24KB

Download
memory/2236-9-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/2236-3-0x00000000075D0000-0x0000000007B74000-memory.dmp

Filesize
5.6MB

Download
memory/2236-8-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/2236-1-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/2236-6-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/2236-2-0x0000000004B30000-0x0000000004BD6000-memory.dmp

Filesize
664KB

Download
memory/2236-11-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/2236-0-0x0000000000210000-0x0000000000276000-memory.dmp

Filesize
408KB

Download