7434706d36f02602f2f9a5e27bddc5356706b43b0338aa42f5836ce0a4c57b02

Analysis

max time kernel
1s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

048553ef5c85e79f9c24c689711ef879.exe
Size

56KB
MD5

048553ef5c85e79f9c24c689711ef879
SHA1

b1394761bd39be240351f032478d7288998b03cb
SHA256

7434706d36f02602f2f9a5e27bddc5356706b43b0338aa42f5836ce0a4c57b02
SHA512

88b28360c9cf1e71abcf9dfff0bc96f3338070c82c6b8acdf45f1e8b14bcdd52616cd49b32dbca3f2289290c5a501008a0e132249369b81ab201421edf899e08
SSDEEP

768:524jtVTHtAMkZpZmnABdRmUV/ccDUsijeSfzhzJUPdVGpznGvmBJNwwUwdOkfP1K:5TnTM3JBdRzRccCfllkLGsmXNwVQO81

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1004	1768	048553ef5c85e79f9c24c689711ef879.exe	30
PID 1768 wrote to memory of 1004	1768	048553ef5c85e79f9c24c689711ef879.exe	30
PID 1004 wrote to memory of 1632	1004	msedge.exe	29
PID 1004 wrote to memory of 1632	1004	msedge.exe	29
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 4544	1004	msedge.exe	39
PID 1004 wrote to memory of 1828	1004	msedge.exe	38
PID 1004 wrote to memory of 1828	1004	msedge.exe	38
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32
PID 1004 wrote to memory of 4340	1004	msedge.exe	32

C:\Users\Admin\AppData\Local\Temp\048553ef5c85e79f9c24c689711ef879.exe
"C:\Users\Admin\AppData\Local\Temp\048553ef5c85e79f9c24c689711ef879.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.tim.com.br/portal/site/PortalWeb/menuitem.06243559e24e67a19a132910703016a0
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6572 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6572 /prefetch:8
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10502595705790627154,6711917893917146312,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
    3⤵
    PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffdad1746f8,0x7ffdad174708,0x7ffdad174718
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2233979d35a954191a3fcf3728db82e3

SHA1
61ae5aeb2c2bef18c26a5b400aa84b5e765f2443

SHA256
6a90567395878ceab3b1bc167cdec0279213a1613a5a28b2738802d511e3e88f

SHA512
b1a732f3528a8a919b2118461011d733f06f461f755298be759f4c3251c3232ca9e215b3c80d0c04028fe03addef91c177a27b982f3c94209ac0687ecb80c21e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
960db6c6ecfaf1429c0693ad920d0328

SHA1
f83894daa507d7d665735a71dcd03ac869920c0a

SHA256
a1bce72430ec8b58e9cf63773903f0d6f01aaf54efa3304e18b441ef06fba591

SHA512
5a13d26a1449ef0494ce7dca3a1fa549fcd3484591d312c675ecd87bd724aa0d5627d4e3b1d5f60f3186caf526499a23732af8b57c93f8072b55eb65c03a3cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ed0a5da1815a927bf3f628a947357ee5

SHA1
91b4d075a2bf4bdc8e6c4b1c68914dc323c00275

SHA256
f470f08ebaef2a83f4777beea18876a951c4879eb15f8a887d5b96109be373a2

SHA512
6e7113d3ef47101576b21706c4e8bcfd9976bdd5ded9e46158652b82250ff1704a314489e73be05e494505d7b5ce506ef7110562408260f55ee318a6450dae1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58053b.TMP

Filesize
3KB

MD5
091a8473c175eabd6444d015be4fe8b7

SHA1
7581695031260340c6ad3967c7a665b82ac58727

SHA256
fcc6ff5bbc23dc7feb36e0cf8afc85eb991e25cf6a16a43fc9f671374231533c

SHA512
2300bbf84ef8bbb657b8a8a8c41ccb592ece2ef68fa7c3a2f230261fe284e9ec194c24186cbc8fa8063351b02b9abbe847c00e60c4e5e22bed7cd83c4f7e7b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9931cc42c3e7a264f46b77dafae541d

SHA1
4497320ca449172d6d11c92b2e67fadfc6ef9b5b

SHA256
00603f156eac8928d7ca23ac7845df295743d9cc82a6484384aef00accc72568

SHA512
ad4b9ff5f0b8691f666c8b10055ecf7d9efc3bccb4ae1f753479d386d550461f00394aacbeaf5865dfa9bedadbe194a40279bc4601b9bed59954f6098fad66ec

Download Submit
memory/1768-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1768-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download