agenttesla | d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c

Analysis

max time kernel
164s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2023 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe
Size

787KB
MD5

bc093d7923b582bc37b09a814940a4e4
SHA1

4ff679166f942395b2d335757f759f39fe8dcdd4
SHA256

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c
SHA512

4f1eb3dd9df2bb7f80a47d39083522c3255102bed9c29fefda6513f4a0224287138c64911360acec8140f76f8b2d483d14f28a30ea12d66661015d3592401af7
SSDEEP

12288:QWodJz/ZGPpglaJwnQieFtD6Ba+FdEmp2UdAmhu1qCvRUULCeNPSiyyjK:QzEpglw53t2I02wfU1PnNPd8

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe

Drops startup file 1 IoCs

Processes:

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe

description	pid	process	target process
PID 2484 set thread context of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4424 4032 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
4424	4032	WerFault.exe	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exeRegAsm.exepowershell.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe
4032	RegAsm.exe
4032	RegAsm.exe
2700	powershell.exe
2700	powershell.exe
2488	msedge.exe
2488	msedge.exe
4976	msedge.exe
4976	msedge.exe
5024	identity_helper.exe
5024	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	4032	RegAsm.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exepowershell.exemsedge.exe

description	pid	process	target process
PID 2484 wrote to memory of 2700	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	powershell.exe
PID 2484 wrote to memory of 2700	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	powershell.exe
PID 2484 wrote to memory of 2700	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	powershell.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2484 wrote to memory of 4032	2484	d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe	RegAsm.exe
PID 2700 wrote to memory of 4976	2700	powershell.exe	msedge.exe
PID 2700 wrote to memory of 4976	2700	powershell.exe	msedge.exe
PID 4976 wrote to memory of 4344	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4344	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2816	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2488	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2488	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2360	4976	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe
"C:\Users\Admin\AppData\Local\Temp\d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffbb7e146f8,0x7ffbb7e14708,0x7ffbb7e14718
4⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
4⤵
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
4⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
4⤵
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
4⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
4⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
4⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:1
4⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
4⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
4⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,881475020781298070,13993497710415512573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
4⤵
PID:4916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1524
3⤵
- Program crash
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4032 -ip 4032
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0affe8c036ad6623ac8987c73d1d9a44

SHA1
38cdf4b9ec2b333b0e2727ee1c58d1c69aa86ca8

SHA256
4e95417fec1f4c0443dd8451a0cbb7d5ffc3ce82d9adea4ef83f11e71ab71f5c

SHA512
699fea44520e08c9e84de69ca6056a16bb3e25c6d507cc1a0f6f3d939f17be008d9ff99d493c58122d98bb47afcfc88e78dd6cc6436ddb502f75d52d1919eef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c58ea7369f777cf175749195fb146d0b

SHA1
6f19507efc3fe8472ac09c2856de3c6e2fe7ab15

SHA256
ba66923e512c387ec9b147946e497a7517026aecac68fe58ffdfa575d3f353ce

SHA512
d7f0fcd31aa676e2d9980d1780569ed953f889dbb978d46ce1fb84d4f00c1acd77a054ce69f75673e118dac30f0a557c10e00758f388aadaea3da9095cd366a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
360c3644f72011b9f8734ee519d2b0a0

SHA1
8d6fa174a488b382e9cf10e7aa4ef91b80be6cdf

SHA256
33aac598885bc23db7d2f9951d4f1874a618b9f34a849e71c7f31923934e146d

SHA512
db85968c1c5fbc7e1d1acffc10e1ad87dd05fd6e3fe972fab4be198438207ea9fa9f4b940f6a5f0ed5ec105229f7a1848cb1e44e813c5ef3b2b6341431f04d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
079b5d05d96758c1e58b37152513bcfd

SHA1
0aff4827d85871241335c5cc611006f675389eea

SHA256
bd70d998dc46d3123b260f5b841d15c268605dc782dd5ff3d1e602f5a254f7c3

SHA512
989ddf849aace92c0f8544b62190ccb72986e7464737240903fbf2c6cbb60347eed2cb82e0bb1aff497a7d4235e999efee9b04b02371f7220812f67a037f95e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
a553ed37741112dae933596a86226276

SHA1
74ab5b15036f657a40a159863fa901421e36d4fa

SHA256
ec16b2f20ead3d276f672ae72533fcc24833c7bcfd08e82abf8c582e1bed5e87

SHA512
25d263aeeda0384b709e1c4ec3f6dba5cfcb8577e026d66846c2045b543f6446439b946163b1ea8f7e53cc6ebf38c93172452bd43e2560b42b56c4d13625e107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
17856d4c2f01908b4af993e11f59b5ed

SHA1
f922774272aed12d253ae565ad687c4f9d921ff1

SHA256
f9698aa2f82a4e7c1498bf0f45249c11e3298b58e0e070eb5e45c748bf83f026

SHA512
e09afc37d0d04689891915306c5d56724420dbef93f74c81c63033a559e3e0ce929023e77a34384a8ab597db54814e820a5ebf13492f0f820f27d95fb10cab47

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b33lxm2h.zi5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_4976_KFAPIMNMPWGTZINZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2484-5-0x0000000005B10000-0x0000000005B50000-memory.dmp

Filesize
256KB

Download
memory/2484-0-0x0000000000FD0000-0x000000000109A000-memory.dmp

Filesize
808KB

Download
memory/2484-9-0x0000000006D00000-0x00000000072A4000-memory.dmp

Filesize
5.6MB

Download
memory/2484-8-0x0000000005B00000-0x0000000005B10000-memory.dmp

Filesize
64KB

Download
memory/2484-7-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2484-6-0x0000000005B50000-0x0000000005B9C000-memory.dmp

Filesize
304KB

Download
memory/2484-19-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2484-4-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2484-3-0x0000000005B00000-0x0000000005B10000-memory.dmp

Filesize
64KB

Download
memory/2484-2-0x0000000003650000-0x00000000036A8000-memory.dmp

Filesize
352KB

Download
memory/2484-1-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2700-11-0x0000000003310000-0x0000000003346000-memory.dmp

Filesize
216KB

Download
memory/2700-43-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2700-35-0x00000000068F0000-0x000000000690E000-memory.dmp

Filesize
120KB

Download
memory/2700-36-0x00000000069C0000-0x0000000006A0C000-memory.dmp

Filesize
304KB

Download
memory/2700-37-0x0000000007940000-0x00000000079D6000-memory.dmp

Filesize
600KB

Download
memory/2700-38-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/2700-39-0x0000000006E40000-0x0000000006E62000-memory.dmp

Filesize
136KB

Download
memory/2700-14-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2700-33-0x0000000006330000-0x0000000006396000-memory.dmp

Filesize
408KB

Download
memory/2700-34-0x0000000006480000-0x00000000067D4000-memory.dmp

Filesize
3.3MB

Download
memory/2700-28-0x0000000006190000-0x00000000061B2000-memory.dmp

Filesize
136KB

Download
memory/2700-17-0x0000000005A60000-0x0000000006088000-memory.dmp

Filesize
6.2MB

Download
memory/2700-18-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/2700-15-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/4032-54-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4032-20-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-21-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4032-22-0x0000000004F30000-0x0000000004F96000-memory.dmp

Filesize
408KB

Download