agenttesla | 5bbaedb23ca1594e649704f9d0d6bdc9fd1aeca05187b62169c44a98f2aba1a0

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FT23194060101821.exe
Size

357KB
MD5

019012e11fcf33bde064894821cd84b7
SHA1

082751450a7064dfbfeb43f34a34be2ba3b24eac
SHA256

31dd42f85893cd5e7db1645bb8eae25f792c11be8eeeb602ac89148afb60becb
SHA512

3eafa84ce7add46b1ce7798ed361b42505c6d5b148543ee6b1c0cb7ad3b030800d0e75a0778d2bf51a67409a055d9eac01d9f10f67a6e002af1d152ab6afea00
SSDEEP

6144:kARcM3CjleuEn1IETITGx5PmCyxq70y5BDG9DnSgiobI+H5/8b:VRcM3CC1zZXf70nypi2

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
kex#-rHjHM4qKk52
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FT23194060101821.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation	FT23194060101821.exe

Drops startup file 1 IoCs

Processes:

FT23194060101821.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs FT23194060101821.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

FT23194060101821.exe

description pid process target process

PID 4552 set thread context of 232 4552 FT23194060101821.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5080 232 WerFault.exe RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs	FT23194060101821.exe

description	pid	process	target process
PID 4552 set thread context of 232	4552	FT23194060101821.exe	RegAsm.exe

pid	pid_target	process	target process
5080	232	WerFault.exe	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

1112 ipconfig.exe
2428 ipconfig.exe

pid	process
1112	ipconfig.exe
2428	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

FT23194060101821.exepowershell.exemsedge.exemsedge.exeRegAsm.exeidentity_helper.exe

pid	process
4552	FT23194060101821.exe
4912	powershell.exe
4912	powershell.exe
940	msedge.exe
940	msedge.exe
1988	msedge.exe
1988	msedge.exe
4552	FT23194060101821.exe
4552	FT23194060101821.exe
232	RegAsm.exe
232	RegAsm.exe
232	RegAsm.exe
1048	identity_helper.exe
1048	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1988 msedge.exe
1988 msedge.exe
1988 msedge.exe
1988 msedge.exe
1988 msedge.exe
1988 msedge.exe
1988 msedge.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

FT23194060101821.exepowershell.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 4552 FT23194060101821.exe
Token: SeDebugPrivilege 4912 powershell.exe
Token: SeDebugPrivilege 232 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4552	FT23194060101821.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	232	RegAsm.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FT23194060101821.execmd.execmd.exepowershell.exemsedge.exe

description	pid	process	target process
PID 4552 wrote to memory of 3064	4552	FT23194060101821.exe	cmd.exe
PID 4552 wrote to memory of 3064	4552	FT23194060101821.exe	cmd.exe
PID 4552 wrote to memory of 3064	4552	FT23194060101821.exe	cmd.exe
PID 3064 wrote to memory of 1112	3064	cmd.exe	ipconfig.exe
PID 3064 wrote to memory of 1112	3064	cmd.exe	ipconfig.exe
PID 3064 wrote to memory of 1112	3064	cmd.exe	ipconfig.exe
PID 4552 wrote to memory of 4912	4552	FT23194060101821.exe	powershell.exe
PID 4552 wrote to memory of 4912	4552	FT23194060101821.exe	powershell.exe
PID 4552 wrote to memory of 4912	4552	FT23194060101821.exe	powershell.exe
PID 4552 wrote to memory of 3988	4552	FT23194060101821.exe	cmd.exe
PID 4552 wrote to memory of 3988	4552	FT23194060101821.exe	cmd.exe
PID 4552 wrote to memory of 3988	4552	FT23194060101821.exe	cmd.exe
PID 3988 wrote to memory of 2428	3988	cmd.exe	ipconfig.exe
PID 3988 wrote to memory of 2428	3988	cmd.exe	ipconfig.exe
PID 3988 wrote to memory of 2428	3988	cmd.exe	ipconfig.exe
PID 4912 wrote to memory of 1988	4912	powershell.exe	msedge.exe
PID 4912 wrote to memory of 1988	4912	powershell.exe	msedge.exe
PID 1988 wrote to memory of 4264	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 4264	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 1440	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 940	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 940	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 2988	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 2988	1988	msedge.exe	msedge.exe
PID 1988 wrote to memory of 2988	1988	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\FT23194060101821.exe
"C:\Users\Admin\AppData\Local\Temp\FT23194060101821.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:1112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4b6f46f8,0x7ffb4b6f4708,0x7ffb4b6f4718
4⤵
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
4⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
4⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
4⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
4⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
4⤵
PID:496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
4⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
4⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
4⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
4⤵
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5878151922844337588,15911347667054577973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
4⤵
PID:4564

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:2428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:1968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 1524
3⤵
- Program crash
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 232
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
803d3296977a04854a8a82bf19b3bece

SHA1
dd10ae414175e255fcb0237332fce3a6dcb32f1a

SHA256
579bf03a4f105a6bc625b084649a05f732d2d2cea9f747fd68058b6573139634

SHA512
d6c48ea944714b33f3816127eb2deccd7c20ad7c7ea276d1952b16abdcfc6185e1d99bcde64827338353a415b758482c846eaa778fa03a0e58f0b7c4e30f6204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
51420af986f34d1e928cfbe279ca046a

SHA1
78cca093243cc3e1372b362977cbfa6d05a18877

SHA256
f7673dca022e766523843a956e8914f73cd226a7c4bc27ab1852089c3ac91515

SHA512
5655db678a1542ede35f984a09b4de1e39f59137ae71159aa45c78d103efa172b4ccddb5f087d0874f07c6db74e69d34ae9b0b07c1aabfcaed2afe9a52f013dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b0b6f14687f577d2650fd512598b698

SHA1
9f010d7d37744fe090b8adb46ebf8c80a1946484

SHA256
bfbd1ecc6c961913ad7839035091c9680ad3bc965c6086296acdb5710a44d408

SHA512
dfadbbfe0af2db60062b7e1bdcea1bf7c896d4ba5d7654a885589cc7b917f5144a092e8acdcead43b83fc5faa4dade81f757cdba9c5785687e92647c2c0862ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b41410a88af61fbe6bea184ebbb27047

SHA1
953d7d85b0dc4aa22a4fd6895571161f9a91156e

SHA256
94fe04478cd8fa80737ae1007952ab7772200bbc200ab0d6fa72d9c1660e6ad9

SHA512
2389382b3a55d57c5359c4f3a0cc2aef94200bfe967a6f1899235c477519ecfb56de2f48d9c6b5949d0d12064651c6161052f1a31b0f97dcf615aafa9f98423c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
a553ed37741112dae933596a86226276

SHA1
74ab5b15036f657a40a159863fa901421e36d4fa

SHA256
ec16b2f20ead3d276f672ae72533fcc24833c7bcfd08e82abf8c582e1bed5e87

SHA512
25d263aeeda0384b709e1c4ec3f6dba5cfcb8577e026d66846c2045b543f6446439b946163b1ea8f7e53cc6ebf38c93172452bd43e2560b42b56c4d13625e107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba2a89d69a1bf25f8ef9cc70edb939ff

SHA1
c4592cd838202d0401d13acecb42e90fb81acf5c

SHA256
a6dc21d51b680bf9747a19f2078ad7ab701cb1c2a41a122c2e709b6d8c3bba31

SHA512
7c1e5dab62b25324f6ceaacc990dcc0a8ea6150fbba8e84aa95144838089bca2d6e0024c2d051260246df975aa30397754651df906555d6643e8d5f986135cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohpvdkic.t3y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/232-87-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/232-83-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/232-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/232-117-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4552-10-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4552-11-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/4552-0-0x0000000000F10000-0x0000000000F70000-memory.dmp

Filesize
384KB

Download
memory/4552-2-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/4552-3-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/4552-4-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/4552-5-0x0000000005AD0000-0x0000000005ADA000-memory.dmp

Filesize
40KB

Download
memory/4552-6-0x0000000005B70000-0x0000000005BCA000-memory.dmp

Filesize
360KB

Download
memory/4552-7-0x0000000005BD0000-0x0000000005C10000-memory.dmp

Filesize
256KB

Download
memory/4552-8-0x0000000005D10000-0x0000000005D50000-memory.dmp

Filesize
256KB

Download
memory/4552-9-0x0000000005D80000-0x0000000005DCC000-memory.dmp

Filesize
304KB

Download
memory/4552-1-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4552-81-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4912-31-0x0000000005BB0000-0x0000000005F04000-memory.dmp

Filesize
3.3MB

Download
memory/4912-33-0x00000000060A0000-0x00000000060EC000-memory.dmp

Filesize
304KB

Download
memory/4912-14-0x0000000004A70000-0x0000000004AA6000-memory.dmp

Filesize
216KB

Download
memory/4912-15-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4912-35-0x0000000006560000-0x000000000657A000-memory.dmp

Filesize
104KB

Download
memory/4912-36-0x00000000065B0000-0x00000000065D2000-memory.dmp

Filesize
136KB

Download
memory/4912-34-0x0000000007020000-0x00000000070B6000-memory.dmp

Filesize
600KB

Download
memory/4912-40-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4912-32-0x0000000006070000-0x000000000608E000-memory.dmp

Filesize
120KB

Download
memory/4912-18-0x0000000005190000-0x00000000057B8000-memory.dmp

Filesize
6.2MB

Download
memory/4912-20-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/4912-26-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/4912-16-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4912-19-0x00000000058C0000-0x00000000058E2000-memory.dmp

Filesize
136KB

Download
memory/4912-17-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download