162d8c5fdc97edc3d48e6b66df6aa40199b9f568502624f06b4ba67b64a7ed20

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19b6009e7031b11d752bd048e765361c.exe
Size

107KB
MD5

19b6009e7031b11d752bd048e765361c
SHA1

ef10b8e9a3a19019d7e405838cce7364e617c90e
SHA256

162d8c5fdc97edc3d48e6b66df6aa40199b9f568502624f06b4ba67b64a7ed20
SHA512

5efc719a558b8648016a4d9d8b318f5bfe0c91f92b4ac01162db37df458e3b16b3982594c9eaa40742ba9105a8e354e8e1e7466418ded6e830e856a5f326e651
SSDEEP

3072:qX7DItrfaocyTgfsqQOlJFWDpsaLfnnOGZEetBdsVI8x:qsaocyLCFW1mMtBS/x

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
532	19b6009e7031b11d752bd048e765361c.exe
532	19b6009e7031b11d752bd048e765361c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
1640	identity_helper.exe
1640	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4960	532	19b6009e7031b11d752bd048e765361c.exe	91
PID 532 wrote to memory of 4960	532	19b6009e7031b11d752bd048e765361c.exe	91
PID 4960 wrote to memory of 624	4960	msedge.exe	92
PID 4960 wrote to memory of 624	4960	msedge.exe	92
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 3176	4960	msedge.exe	93
PID 4960 wrote to memory of 952	4960	msedge.exe	94
PID 4960 wrote to memory of 952	4960	msedge.exe	94
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95
PID 4960 wrote to memory of 1592	4960	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\19b6009e7031b11d752bd048e765361c.exe
"C:\Users\Admin\AppData\Local\Temp\19b6009e7031b11d752bd048e765361c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dl3.9minecraft.net/index.php?act=dl
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa9f0a46f8,0x7ffa9f0a4708,0x7ffa9f0a4718
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3204019038668938407,1617647490501430241,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4128 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
0bc89b50a2d473cfa76b8b85ef9d5f19

SHA1
ff90fe9fc58552162f137f46ed13083598463536

SHA256
57ed19cfc0c0a02989ed03bd9504d70370aeaf36afc57b8b1a3990bbec1149b2

SHA512
22d22b7ff1715c89300aaef0067fb6b7a58ac16be36b86c2f6d69d44d1a8e5e7a1279043fae322b81fdf3a61af045733507574ce8ec5264bddf3725bd1da2273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
877B

MD5
bf342136944d4562bb3ed97a8043f907

SHA1
8bbdb28233ff3a13338336fa3acf0dd86c77d58a

SHA256
295a816688da69552051185b53830d3bd75b0a6f78f26ef795891d042d28c018

SHA512
5ec0a463ac7c31acad674e86c708fb51aaaeff34330fcb54e25d0d3c37bed1be9e61438b1457cccb4a29121a4f0efc44ae3359c2605b510d9c83547b89653fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba05a9b48d1c742e249f7c5b120e9614

SHA1
8777d6aa4f4e47d66aa79d9170d30fa73de2982d

SHA256
4d9ca2f1b457cb6a2da20ef8c732c5c7e02025531b1ddd6479c8ed1530e8e6aa

SHA512
61b5164866c8c41e54f8a8c42bf7f442232c9889976642419686ada59bc98d0a9dd60bc7d4647e41da834fbb4036d61f7a0674b43ad3783f80ac90b979d337ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dafc64e97319e8d8ec8155abc72d3858

SHA1
7acc45b1b3730a4990ebe1464c25b7435e784b7e

SHA256
5726502744d1d73842fade510540657f8c6308e62c4e2f52047068e7bfce31db

SHA512
558d1ac7e6de76ed0bf2b1b6be98f252ed366ff388181a8d86a9697acdbd2149192307c1faf1b8b9793fce90bfc401aaddb6ffbfba33658637f3167d6a458af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63d8db178bca8dbaf177f44483f3cc6e

SHA1
708c5797c9f8c53b6812b523545e9240c47f294c

SHA256
387e5bb487bc258b9c0809c7f570265aae2fcafd0215d22c704b55553a176ee2

SHA512
538a8e00280e91d8ff3e0b52fd426e884378aeea8ab50459b396fb161c5577345b463e269127a503802c7238d0776c83437986a34329239e1a54d288c98297c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c5837108e4fe39056929b5a6cc30d4f

SHA1
f93281af569b30c3f997296b63fee0a1e1725e8c

SHA256
a9ed5ce83f16623773ab11a98bf3a33ed6de367465e57765bfa0bc527073dbeb

SHA512
d3a48684273e9540d70f8202d5f4bec53e60a0a6cff8430d0bae7b8ae33ae508938a59130dad5ca9d2a4ce9cc164825afb233f70afff552746f1a0d4bec5d78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
13c9c5db0e970e306104a777e365178e

SHA1
308db7a9502a1f0b7ed9bcf9007d414c0ec6e390

SHA256
464f58bd59c0f28b22c76a168598bab59efd3a78f32fad9fb1ae8d9e704298db

SHA512
c3fca5ded8f31b7c907282df86792d3dc29c388f7fcf49b7d75d9bb8f3408624ef6ee836bffb707cc4caf2b55ca4e1c34b72967ddc6fc082a450e5786220eea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf6D81.tmp\System.dll

Filesize
23KB

MD5
125aebb055446fb52aa5956cf99e8a9a

SHA1
6b58fd08a8ff2763219cc6b0dcdb875f9970f850

SHA256
2e1b11ee20e5061ea86dc6b01e3efc659e887540afcab7317cdfd6a8eff87ec3

SHA512
5f85e48bd3ae2fd2be0595b93cbf74674e0281210688dcc73691178b295a702e8d43898afb6e5d8b7e82de98b4ee28194c9838ddf8279cde85f7fe48d34dc8b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf6D81.tmp\nsDialogs.dll

Filesize
11KB

MD5
790d227d847f7571c8d58a79057a469e

SHA1
75c347b1441383c61166b615dfd6e7e65b04629f

SHA256
37e99ab9db0045870e31db147438cf0c69b6fcdec4f3737a9743c447cbc0c3c0

SHA512
5821605bfb3e57ddfcc1a74829968814aae92b13cb713ef3628913d9112d493117e8aa9cc437770facdcd2d4bd1e53a271d491e6b4d3e4cff53bd027f4b07f4c

Download Submit
memory/532-11-0x000000006E3C0000-0x000000006E3CD000-memory.dmp

Filesize
52KB

Download
memory/532-12-0x000000006E940000-0x000000006E94A000-memory.dmp

Filesize
40KB

Download
memory/532-10-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download