agenttesla | 8fc8d08ac95f945b863195ee3556c1e756754faff354db781a67a9323b4c06fc

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2023 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

payment status.exe
Size

611KB
MD5

b3cb7b5092ec2f49be062a87a6335041
SHA1

273ee251d431823cc65e1b9e177c34b36da3b578
SHA256

8fc8d08ac95f945b863195ee3556c1e756754faff354db781a67a9323b4c06fc
SHA512

04b1751627bd0d63cf9aa137738a7c28f0c5d827d2d69dfce45d3075321af5f25d09b51b10203d103ce585ae288f8a2cb3826f9fa780a1f630c8c0cd135e6f5b
SSDEEP

12288:suod5zlZmSVaFl3LLTIhbH5TtOBoLFv0X1iMM0pwsNdRjH1y92Tneg:kzOSEXL/IhbHnuMF8X1iFsFH1y92ag

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
kex#-rHjHM4qKk52
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

payment status.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Control Panel\International\Geo\Nation	payment status.exe

Drops startup file 1 IoCs

Processes:

payment status.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs payment status.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

payment status.exe

description pid process target process

PID 4236 set thread context of 2316 4236 payment status.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3480 2316 WerFault.exe RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs	payment status.exe

description	pid	process	target process
PID 4236 set thread context of 2316	4236	payment status.exe	RegAsm.exe

pid	pid_target	process	target process
3480	2316	WerFault.exe	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

3908 ipconfig.exe
2296 ipconfig.exe

pid	process
3908	ipconfig.exe
2296	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

payment status.exepowershell.exeRegAsm.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4236	payment status.exe
2212	powershell.exe
2212	powershell.exe
2316	RegAsm.exe
2316	RegAsm.exe
2680	msedge.exe
2680	msedge.exe
2292	msedge.exe
2292	msedge.exe
436	identity_helper.exe
436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

payment status.exepowershell.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 4236 payment status.exe
Token: SeDebugPrivilege 2212 powershell.exe
Token: SeDebugPrivilege 2316 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4236	payment status.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	2316	RegAsm.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

payment status.execmd.execmd.exepowershell.exemsedge.exe

description	pid	process	target process
PID 4236 wrote to memory of 3008	4236	payment status.exe	cmd.exe
PID 4236 wrote to memory of 3008	4236	payment status.exe	cmd.exe
PID 4236 wrote to memory of 3008	4236	payment status.exe	cmd.exe
PID 3008 wrote to memory of 3908	3008	cmd.exe	ipconfig.exe
PID 3008 wrote to memory of 3908	3008	cmd.exe	ipconfig.exe
PID 3008 wrote to memory of 3908	3008	cmd.exe	ipconfig.exe
PID 4236 wrote to memory of 2212	4236	payment status.exe	powershell.exe
PID 4236 wrote to memory of 2212	4236	payment status.exe	powershell.exe
PID 4236 wrote to memory of 2212	4236	payment status.exe	powershell.exe
PID 4236 wrote to memory of 4264	4236	payment status.exe	cmd.exe
PID 4236 wrote to memory of 4264	4236	payment status.exe	cmd.exe
PID 4236 wrote to memory of 4264	4236	payment status.exe	cmd.exe
PID 4264 wrote to memory of 2296	4264	cmd.exe	ipconfig.exe
PID 4264 wrote to memory of 2296	4264	cmd.exe	ipconfig.exe
PID 4264 wrote to memory of 2296	4264	cmd.exe	ipconfig.exe
PID 2212 wrote to memory of 2292	2212	powershell.exe	msedge.exe
PID 2212 wrote to memory of 2292	2212	powershell.exe	msedge.exe
PID 2292 wrote to memory of 3932	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3932	2292	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 4236 wrote to memory of 2316	4236	payment status.exe	RegAsm.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1764	2292	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\payment status.exe
"C:\Users\Admin\AppData\Local\Temp\payment status.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:3908

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1ea446f8,0x7ffd1ea44708,0x7ffd1ea44718
4⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
4⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
4⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
4⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
4⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
4⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
4⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
4⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
4⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
4⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17680258830284332140,7489998650114714735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
4⤵
PID:4592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:4264

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:2296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1524
3⤵
- Program crash
PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2316 -ip 2316
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c89e9212e22e92acc3d335fe9a44fe6

SHA1
c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f

SHA256
18c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44

SHA512
c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0dc82fe5426878939d82c981b60d1e61

SHA1
4806673c20e49b1d02558061fd81321df7a04014

SHA256
d80ccb1726a90759ceab6ebf9eca34e581c86e3c497f3f20f9a139958d08852f

SHA512
ae5fa18e9322170ad7a1d6ce3c5470acbf85a0f0b486683ef233b9431d13a7cc0b7987268a5c66cb144cc29a03c77c35de4af06090631406b0ab04632072aed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
87079f34df72234e90a05892ec2e0387

SHA1
005874244f1e6963a95190da0c78b99e6d8969f4

SHA256
9478e01695060e38638af4cfda8d5af2f77dbd4bce20051ad0b1397ffb91a312

SHA512
b97bbbc7605f99374d8dc547865c394aefe5aedec77f0e5a434dd32d28d549324202985c5b6d6ddc5d76e362f62498a4a08ab0fe70c7e70b96296f273e57fd3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
716df52be9c55bd97949ac3e4933a0c9

SHA1
66c9f0460d0419bad8dec05c17ae743040c462d6

SHA256
f912ca6393fd40f6bef42c014420819f79cca5c4f028f3ea09144fb903f23212

SHA512
f8aac98710f3f05b2d45da9094fc60db792989bd0739d4305ff31ddb62d8f8fcd1e5725aa4ae334f9f5dbd0515de4f9e0c1d67e9fbe6289c831a28ebbe788f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4190d3c273740b1f4af0f032068e4cc1

SHA1
f81c195920503e5b4c5a0ad1dfc4c8b1e2c9a7d6

SHA256
0c6eebe5e92fc07fd38bb88e56585d612b3d532ad65e253a22642f0e122514cd

SHA512
1a38e532f80f5225d3491db2fb41cd0c3061414ff512c25ab7897bd61afc4b07fd4cba49db6286a36788b330c85995b799337c0bab8e01b19d81bbe2ccae89ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d7b2b29ef1d9a33e61e1167984c8ca3e

SHA1
9a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34

SHA256
7d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2

SHA512
3cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63f1ed5840e0f9d96ffc7077597a4f7b

SHA1
c97adf366a1558626e0e7be3bd6e6d4b397a231e

SHA256
46bc5564e9c8d515fb4fb118b72323ba69d03ec8c85a3aba2458fa20699a56d2

SHA512
85087d55911dcf7d033deb166f9107f77108b90e295502908d261ea6ac386a20ffd07675c89074b69fb31800288c79fb99db3d45e2d94e66560844fc4d8d733a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yzdehsjk.3dx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_2292_LAMAWAETOELLQDYB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2212-30-0x0000000005FF0000-0x000000000603C000-memory.dmp

Filesize
304KB

Download
memory/2212-12-0x0000000002530000-0x0000000002566000-memory.dmp

Filesize
216KB

Download
memory/2212-15-0x0000000005100000-0x0000000005728000-memory.dmp

Filesize
6.2MB

Download
memory/2212-16-0x0000000004EC0000-0x0000000004EE2000-memory.dmp

Filesize
136KB

Download
memory/2212-17-0x0000000004FE0000-0x0000000005046000-memory.dmp

Filesize
408KB

Download
memory/2212-23-0x0000000005830000-0x0000000005896000-memory.dmp

Filesize
408KB

Download
memory/2212-14-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/2212-28-0x00000000059E0000-0x0000000005D34000-memory.dmp

Filesize
3.3MB

Download
memory/2212-29-0x0000000005F00000-0x0000000005F1E000-memory.dmp

Filesize
120KB

Download
memory/2212-13-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/2212-31-0x0000000006EF0000-0x0000000006F86000-memory.dmp

Filesize
600KB

Download
memory/2212-32-0x00000000063F0000-0x000000000640A000-memory.dmp

Filesize
104KB

Download
memory/2212-33-0x0000000006450000-0x0000000006472000-memory.dmp

Filesize
136KB

Download
memory/2212-37-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/2316-57-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/2316-109-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/2316-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2316-58-0x0000000005590000-0x00000000055A0000-memory.dmp

Filesize
64KB

Download
memory/4236-8-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/4236-9-0x00000000064F0000-0x0000000006A94000-memory.dmp

Filesize
5.6MB

Download
memory/4236-55-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/4236-0-0x00000000006E0000-0x000000000077E000-memory.dmp

Filesize
632KB

Download
memory/4236-7-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/4236-6-0x0000000005350000-0x000000000539C000-memory.dmp

Filesize
304KB

Download
memory/4236-5-0x00000000051C0000-0x0000000005200000-memory.dmp

Filesize
256KB

Download
memory/4236-4-0x0000000005170000-0x00000000051B0000-memory.dmp

Filesize
256KB

Download
memory/4236-3-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/4236-2-0x0000000005100000-0x0000000005158000-memory.dmp

Filesize
352KB

Download
memory/4236-1-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download