c2896e90b50b14aa6ad8d39f7d828f92e963f6b756e8cb2d075046913e497a81

Analysis

max time kernel
260s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RC7_UI.exe
Size

830KB
MD5

44be1d272c2f2d32bbc71db7a246982c
SHA1

76c42f9f187a9570775af1d611f04da0765036d2
SHA256

f78e4ed7297aefb1e8c50b976907fda03f20069f9d3958497e260a69ef4ac47b
SHA512

b5417d9c187fbf5abea667531da3381384ba407d2aeb458e4021acf1115fd72f6fec22a30672880fb6581d1db853f2cfae30bd8a85eff7420979d1c2ff52d93f
SSDEEP

6144:jBku01IJVLfsOIJVLfss8XnXwtQ/c72IkoxkDtSP4EIJVLfscz:Vk8VLfwVLfiBVLfVz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
3512	msedge.exe
3512	msedge.exe
1808	identity_helper.exe
1808	identity_helper.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4136	RC7_UI.exe
4136	RC7_UI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3852	3512	msedge.exe	92
PID 3512 wrote to memory of 3852	3512	msedge.exe	92
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 2572	3512	msedge.exe	95
PID 3512 wrote to memory of 4744	3512	msedge.exe	93
PID 3512 wrote to memory of 4744	3512	msedge.exe	93
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94
PID 3512 wrote to memory of 1672	3512	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe
"C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff935b846f8,0x7ff935b84708,0x7ff935b84718
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15051136910791405035,7515586229584034508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5a0b1faa355646bf80278611d08023ff /t 1360 /p 4136
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
26f8219c59547d181c1f9070c2f5b050

SHA1
cbe34c1b41c0d86e1dff1a0bd82b6c803085a39f

SHA256
3f534bb6f67e07afe3baf85bf750122c2e00b86df6aa258e5752dc6c946fc2d2

SHA512
1600ed7fb809d9f4fd571b99e606ac92f0054f684b6b7a3b72ede39d5edaf458cf551c568ca1bf967326bfbdaf2f7178906fb8d15d82c52049fb6c74205c9f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f40b3b288cc67423026f1241c66bfbfc

SHA1
fd5c02a024b0f6fe7163ab5aa6f6ae522fe9b0c0

SHA256
d49014d01d1b3c94496b067160573091b1237d35d2899b40f0c8986a8e3b8332

SHA512
f07184be96d717b552507bcb764d9ea0e7935b3e86044120a359cf7080d8fa7629bc91d0934105a6e7a9bd85fd534d21e3ade18e32fdf6ccc9c8a9057ce77ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a95a62a9b8f6f120c81766aba7e071a

SHA1
c77ee5c3a22348402f26c5caaf2b149815364884

SHA256
12fd22baeda3d8ce3505193df2c0ee2cf131eb91b982cf8976602356e1919b25

SHA512
8fdbfe7c3b14858ebe60051089ca8a93fc6f2610c4b123e9e9fa207270c810959961b3998915467b45c67f5238bb5c911c397e4e75fc605d86536bf688ea094b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f3d2adb5d98c5c27bc2e5f0ec8b28a2c

SHA1
fb25e3e6f7d5002851177669b7714e1a46b8ca12

SHA256
2d34e9d7482f647bdceb41db2b109f3444dcbc8612277390ec3dfefc0ab69bb9

SHA512
34a230a1e4d84639fe278da3539423b8f20dcbf8d7160a68953709901ca262905e252776a5b0e414afd783ddc59228e33c2bdb653cd0f77a41c58b65ee87330a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20bc8064f53d8cae7d8923d252f5a8f8

SHA1
1f6e74e27ac0d04093050c9df0db1e2a5a6a7b3e

SHA256
30f750b5ce541f14797d1a54d2a91ba7e6ef5f1f508ea07a4dd078001bb3db8f

SHA512
10f3336f95f6243268537620c73de52c84139631c8851b9beaebdad62217d2c4772244c95d3ce029651c24c14017b7a93f9098ecbf014f90d30e390cb8094b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
39d270cea7bec1694add52c639fcb8d5

SHA1
cf9d2817b8cc27c27606df9a7f177a756308197c

SHA256
3b978317266c5cef52d7e03c13d7dc9bc8c8f9ce91c86eb65dcddcba0b77ae37

SHA512
44529f1926323e578ba1003e9fa03b9c5e4cf40e136adedbc1928eafa887c6e2b601a748dee2e766f244f54139bf012390762ab1830059b9434b6c8492213b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
5963fcd1b8d36840cce8ec97e5ae998f

SHA1
0f8aa43f3168e8fea75bd8aae3bcea4ba6a24d3d

SHA256
9b02e3abcae5ffa844d0ae84638892379a30028bae33c4024a54f842d65fa737

SHA512
6a818fac77cf83696aa85ede5090f8b8cf75b9390605b222fb92880619e1b9f68f2ccdb582cf5aa31a7e16d563781897ac624fbe90f1ede12a1ed172d9bbc27e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
02a90c7598bce430fe8920922e464388

SHA1
621f6fe562dd0f24c6469dbacee0c64c4e0f5a9a

SHA256
c7243b8a9ae3a0b6d1687181c308387fe2b207f220991add0dc44f19f850f9b6

SHA512
2c71ce32c0ef751174fc16624a7f6953bd27f8c9c405c627f55bbc27700bc27985cab88282c21bb060907daac13c8796b9d33ac90007d6ea70c14047e410f64f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
0481e675db28fde94408855c9090c144

SHA1
640fdc12ebb203768cd7b7953891a0e0cf2a2a57

SHA256
629b468514aa9445c61facccc570bb57bd8e81b335c637017dc68d9a284e6efd

SHA512
7d4fb049b9356441cef88b3cbcf5d4fdc9ce7b3aaf3edf14789256fb86faaefede0519b0e2798628dacc1f2efe237edc47c399c92f560785b2943625c1db9358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
7528b9399c48ee8a9465fc448ca64697

SHA1
a4734d1c8d2c76363b0e6a41f8763e8aca1d3a42

SHA256
f572d180a60c9f8aa398d78a936580635c90e08b1d72f5370d7957cdbd3507fb

SHA512
e4d5b17609eb9f3a056d0c456f73e94bbcae9e1c1b15132a3c6d0346091aa7b7a5edc262c5d1cee760318693eb2b25fba33aa45285ff005fed01ce895adcf2da

Download Submit
memory/4136-8-0x00000000095C0000-0x000000000967E000-memory.dmp

Filesize
760KB

Download
memory/4136-52-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4136-15-0x000000000AF20000-0x000000000AF70000-memory.dmp

Filesize
320KB

Download
memory/4136-16-0x000000000BF50000-0x000000000C6F6000-memory.dmp

Filesize
7.6MB

Download
memory/4136-17-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/4136-18-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4136-13-0x000000000AAD0000-0x000000000AAF2000-memory.dmp

Filesize
136KB

Download
memory/4136-12-0x000000000A9C0000-0x000000000AA6A000-memory.dmp

Filesize
680KB

Download
memory/4136-11-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4136-14-0x000000000AB70000-0x000000000AEC4000-memory.dmp

Filesize
3.3MB

Download
memory/4136-10-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4136-9-0x0000000009550000-0x0000000009592000-memory.dmp

Filesize
264KB

Download
memory/4136-1-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/4136-7-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4136-6-0x00000000058A0000-0x00000000058AA000-memory.dmp

Filesize
40KB

Download
memory/4136-5-0x0000000005890000-0x000000000589A000-memory.dmp

Filesize
40KB

Download
memory/4136-4-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4136-3-0x00000000056D0000-0x0000000005762000-memory.dmp

Filesize
584KB

Download
memory/4136-2-0x0000000005D40000-0x00000000062E4000-memory.dmp

Filesize
5.6MB

Download
memory/4136-0-0x0000000000C20000-0x0000000000CF4000-memory.dmp

Filesize
848KB

Download