1f54110beadb7d01e6efa20e60d235a9ee05db999940286548cb1d8a4da4b2d1

Analysis

max time kernel
169s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b5055e6641b974fb32ea8b000a0b4b1.exe
Size

31KB
MD5

1b5055e6641b974fb32ea8b000a0b4b1
SHA1

5d800197044008a4b4c0159520cc2092e05f3cdd
SHA256

1f54110beadb7d01e6efa20e60d235a9ee05db999940286548cb1d8a4da4b2d1
SHA512

16bf4043d5d731993cc3319f918021024024cdd12e0f1dd33c5c2ef2dcd79033fa8e3ff5e5278a7331d95e7d72096c6e6c3c774210470182ac81cffdc2eb6345
SSDEEP

768:EDiEfgtXinWVWlWUZVfYXmiiznaH6ZO1z:8jfMX+BBaH6ZW

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Internet.exe	1b5055e6641b974fb32ea8b000a0b4b1.exe
File created	C:\Windows\SysWOW64\explorer.exe	1b5055e6641b974fb32ea8b000a0b4b1.exe
File created	C:\Windows\SysWOW64\list.exe	1b5055e6641b974fb32ea8b000a0b4b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
3952	1972	WerFault.exe	87
4684	1972	WerFault.exe	87
3192	1972	WerFault.exe	87
2464	1972	WerFault.exe	87
1468	1972	WerFault.exe	87
3700	1972	WerFault.exe	87
4416	1972	WerFault.exe	87
3292	1972	WerFault.exe	87
116	1972	WerFault.exe	87
5084	1972	WerFault.exe	87
4036	1972	WerFault.exe	87
4396	1972	WerFault.exe	87

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
5092	msedge.exe
5092	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 5092	1972	1b5055e6641b974fb32ea8b000a0b4b1.exe	121
PID 1972 wrote to memory of 5092	1972	1b5055e6641b974fb32ea8b000a0b4b1.exe	121
PID 5092 wrote to memory of 720	5092	msedge.exe	122
PID 5092 wrote to memory of 720	5092	msedge.exe	122
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 3948	5092	msedge.exe	125
PID 5092 wrote to memory of 2692	5092	msedge.exe	126
PID 5092 wrote to memory of 2692	5092	msedge.exe	126
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127
PID 5092 wrote to memory of 2388	5092	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\1b5055e6641b974fb32ea8b000a0b4b1.exe
"C:\Users\Admin\AppData\Local\Temp\1b5055e6641b974fb32ea8b000a0b4b1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 604
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 860
  2⤵
  - Program crash
  PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 860
  2⤵
  - Program crash
  PID:3192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 880
  2⤵
  - Program crash
  PID:2464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1004
  2⤵
  - Program crash
  PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1204
  2⤵
  - Program crash
  PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1220
  2⤵
  - Program crash
  PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1228
  2⤵
  - Program crash
  PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1032
  2⤵
  - Program crash
  PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1228
  2⤵
  - Program crash
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.declaracaodeamor.com/mensagens.php?de=amor
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd2d6646f8,0x7ffd2d664708,0x7ffd2d664718
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5164234600578778156,17336075133189980083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:5240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 796
  2⤵
  - Program crash
  PID:4036
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Modifies registry class
  PID:636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 140
  2⤵
  - Program crash
  PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1972 -ip 1972
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1972 -ip 1972
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1972 -ip 1972
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1972 -ip 1972
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1972 -ip 1972
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1972 -ip 1972
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1972 -ip 1972
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1972 -ip 1972
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1972 -ip 1972
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1972 -ip 1972
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1972 -ip 1972
1⤵
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1972 -ip 1972
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d8442d9-e5c8-4332-bd08-e22044367f78.tmp

Filesize
5KB

MD5
93572b03b7774ad81f9e268e3b02b9c8

SHA1
f332dfa8e1a6e635fc0365c6d28bb97e20cb6cfb

SHA256
83405cbc91d76b67312c4730979b2938ac67354c3d1b4f4fcbe9fb7f0a2557b7

SHA512
4eb2af2adb9c74ab7c8a0898d3527ad2426bc6efcb133e9a8871a7bd975f17cef6f0c826195dab87d6705098595e510fb8e51c97ccc3e82a61502e46a01f3e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
bc8a99723ff5047f567b4ba711c80778

SHA1
4e3ac759aadfee17dae6ccb8dd70aea4e36bb046

SHA256
88a2e50e720e945a61bd5159076fae1704a18e4ea3f7ec1951d9fdeb41d795bb

SHA512
965bb11215c440d0cff66443c3b3280832b42150e51b3fd1d877349aa24eecde1c0f91fd7358fb7838c6c81eb85e69a1df4d7471347326167b8c5d63ef9a3909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
224cc3fbdadc5ca1c46ee69fb05006d6

SHA1
80f235cac3ccdb4db024e0a103dbc7ac937cbd80

SHA256
17e6de3ae59617fa688f478344baa867572966650c047e881fabee5e49435bc8

SHA512
2a66c8301e30dfefcb58c66e3f37ac2bf140e7a75d0a8ea1cca3296709f9c29f337bfac0f649e068cf2ab23622b2a6e9e0ed6c42fa50f80b752b7b4105c60925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f58c1562b3c8d48365277c7f0251fd49

SHA1
f6e76b6a92b94812f1814f5a5562caa06469693f

SHA256
ea073a82bcfe1c79b09056f3d124038e7482aca7120ab4bb238e88766f7e33bd

SHA512
a3a9d13c0b1015980d9052b182090a4ce4a94be67b9398447b0224fb53d1dd78be2837f762648a7cf1d8af57dfeaaa6e9894bb32653a3bdf038805a4108496f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f862fc5f4825155ed03ce87727f71e0

SHA1
3d6c95ab794fd6baff081f9d2da8df6188d2e836

SHA256
91eb40c3919ba8280792aa4dcd9493651ea33d4373a2b7a8392761786fecf3fd

SHA512
2d04b5dd417614fd1fd6ae4e45102a08a25cda402cbcb4e1a44a48a12d70d3949890714709f4fc2929c58965b1e91556e1ae8d2cd0ed21eee8f721cb9a16333a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8PO8IKDM\image21[1].htm

Filesize
12KB

MD5
cdedfa2739174ecbe1d917cccd39a997

SHA1
5692f9c2e13c4218661eb90ddfaec0ced6c15a79

SHA256
f1021db34e41f7a1749672945dd2b77235bd04184376f8ccfff07e613a53685d

SHA512
9ac63c2f46ae781c33ef188a6c2837e452a2d008028eaedd17199748e3c079df45efe4a6ac1e631769b60582d50bf34b993cdcf3607157ec64ab35afedf1570a

Download Submit
memory/1972-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1972-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1972-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download