e3b9bfcb737bc15410e152dbdd6ecae09d4a2d8b29b2a947e180b96280d85c62

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40f95db8aab37c2a8bb79aaa45dd9c4c.exe
Size

329KB
MD5

40f95db8aab37c2a8bb79aaa45dd9c4c
SHA1

8136f4484ab928e260f80dbad9291415f33c9a47
SHA256

e3b9bfcb737bc15410e152dbdd6ecae09d4a2d8b29b2a947e180b96280d85c62
SHA512

d514d9e0298bc408798ef99967832f84460ee157e9d56c6e0e8f6a602f85d533c09ba93fcc4dd56258cae330d440961649960674172c6ee52df6819dc1409d67
SSDEEP

6144:lweA2kc9K8lnVW5GJZ2tNYLj8MfsiR92lrk88LkR/3mYuKxH:lDA4jVzYKj86sialrkxLkRPmYuKxH

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	40f95db8aab37c2a8bb79aaa45dd9c4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	40f95db8aab37c2a8bb79aaa45dd9c4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	40f95db8aab37c2a8bb79aaa45dd9c4c.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
2972	msedge.exe
2972	msedge.exe
5544	identity_helper.exe
5544	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2972	2536	40f95db8aab37c2a8bb79aaa45dd9c4c.exe	95
PID 2536 wrote to memory of 2972	2536	40f95db8aab37c2a8bb79aaa45dd9c4c.exe	95
PID 2972 wrote to memory of 2528	2972	msedge.exe	96
PID 2972 wrote to memory of 2528	2972	msedge.exe	96
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1008	2972	msedge.exe	99
PID 2972 wrote to memory of 1204	2972	msedge.exe	98
PID 2972 wrote to memory of 1204	2972	msedge.exe	98
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100
PID 2972 wrote to memory of 3056	2972	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\40f95db8aab37c2a8bb79aaa45dd9c4c.exe
"C:\Users\Admin\AppData\Local\Temp\40f95db8aab37c2a8bb79aaa45dd9c4c.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=40f95db8aab37c2a8bb79aaa45dd9c4c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9962446f8,0x7ff996244708,0x7ff996244718
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12515938804574653159,11622749991401941707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4392 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=40f95db8aab37c2a8bb79aaa45dd9c4c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9962446f8,0x7ff996244708,0x7ff996244718
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15086742524515062825,12436223816284257952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
bd5b93d244e68a133340b5f537a909f2

SHA1
20583d286afcb89d5f777223b5a4a41a5c2e8b09

SHA256
97f34d8fe9d69eb009251ac9a01f7895306bd6d9da5d79421bb9ec59615bc1e5

SHA512
c6da45a025f1200d44f8ced4d3becd575f69685cb6634733aeb1d874827d7050e03ae4be28b46c1030c8be95877dbb169d22f4bae876fd21180fc0c076d6778d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
036b4fce07a9e7f1137fbfef8efb8e6d

SHA1
9f109f3a6ec3f0a524a7769fdc5920dba03f850e

SHA256
2360b9b0db39e99a32ad7dc2493dd059ccdcee3957f5e4a30b45e6a469e778c9

SHA512
88c8d40c9c4f4c75df47f1a19aa71e8f35d459a828eda23295ab9dbf1c650e777f1f6d802d618d149f0076f8ae2b9f169a6d55fecb98444797f57d42bc6a106e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c655b8139bfdf3438ee8f577dc888ae2

SHA1
b93ca06d0c0c45d4e61e771ce5b783a32b70122e

SHA256
56c99b16bdcd637a039b2af26432d4d9b68ac85e84591a8d8d5398d805c29e0b

SHA512
54d5366d45dd8bd6530e7a5f2562ee64b46ddcec073c1c410e607fd8ddfb03126b9d70cfc7578fef97c87965d5c6c046468a0f8017b78736c4e4112eb42a9d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72368c24bde47168babe48a5e7c5ca6a

SHA1
b76832e197193067833f2733d65ae711885c934d

SHA256
855cc3cb1abe5eb76421534a0e99c294ba813a2e2b32aaa87139a5153c115adb

SHA512
794f1ee8822c636da01393e4f07a9c56d5c41c3dd4a75d0107d7ca2304fc6cbb0137ce59a1adf470ae53842e16b07931b15b79b92224328016dd705dddecd64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b51c4ca64de9f0902d8f427053d8b58d

SHA1
609fb63c96b2a6ba564d843d7e2337eba7adbada

SHA256
d27788b8be01533efcfc6bdd96fb3c7b0264ffe62ce071b315392de82c8a0fec

SHA512
ee46cfc3f3d2fdc2abb06defaff00b1a435f127d58a686d32b701986cda940415c424420d191ab71d603253fef4d3c287781efe0597afd42ad825dcd1b8dff18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4a7fa0c55f5b687a4a91f7e38a2f55b7

SHA1
29b1b080e93f05ab634bb1b9577a66b89e4c241a

SHA256
b15d9ae770ee985adcdeba926070219d5f8eadb5f1c082336503d9e95f4e6efa

SHA512
a84f085a7d837769d0990b7b97a56f9d4476a9cab4810bfbcc08db52d5bddd5c12d5302e0069a1e914640ea42ca2d9b3b2ad4a834cbf3886d4b52e574e1452a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
6304d8a186c86ba43124acbf0a86c60e

SHA1
87a2f45ff1a37e4709329a7b18db87fb685156cc

SHA256
26396546109dac1e8adafff469e8a07e4206572eef9f0a4ae662122df897ffa6

SHA512
dd1fea5860168e7dc9cea843dbf05d4f77a6f5d591c7c571912676509178b02f29f64ec2edf39da461854c84af70123890d4f3fadcee68fa5284138e157ba850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4fe5d078bd0160867f752540d832e9fa

SHA1
33eba477946588fb9354f7bc1d8e03553e98d364

SHA256
5d376152459f8cab7d3bb4948280a95811eab62fffee2211b7d9531c7da5626b

SHA512
737bd249c42d4d14f0a7f4118e3f5c8bfcf77798967af0374e416aaf586a41c0cb0d28cf5f1f1e8ce8f66a9c80f444b1d27860668d117faed9cf8d68767cf777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee86.TMP

Filesize
203B

MD5
d8b6e077a53b38d90c218a62b6b673ba

SHA1
ba8107cd3cef26eeb4fbaa7844b06ed4545e35ea

SHA256
5e6cfed35c46ae25c80acc910507a9dc20b2c2b47cbe464371815d137160e516

SHA512
57749e9735c804fbd61e38290e6c76ecfc0c93816132f78d43299a605db1aac61984dec0edcbd1176b30c3d58b8b3718f15e9a6ef78eec333d6ac5871950a548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d3eded977cd7fe99d361cb7e4c84a373

SHA1
2d965935cde0f133962f7773e2bd8efc45f65a5b

SHA256
1473285da2c5ebbbbfd8f0a52e58bb1ad2f17c40a0acbe4edce04aa4fd12bed6

SHA512
4f77f19c69b01809f16fcce6af332a0801b368b73eb66812b1a869e975adea0a49d46a02c45764709beff8a7f4d3b080c0ca3981d10b7d2a0a6e548f52505db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
c301492033b2eecf50f388a6ad1d1c2c

SHA1
a19b4384bdf317191c3caad517b8f99e2b02ed67

SHA256
7c0274c52dc5df2b4ad4b11d64fdfcd1bc93f3b10b693a2bccb3a2c9dccb003e

SHA512
213aaa487b37167954052709055ea0685ffa2befb60cd4d5f8343b54d6dd68945be6d1ef9452f685b6ec763d1ac3071ad58ea3bee2c14bbc1dc7981ebb1e5a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe642e7078841a3cfbf1a96398b805ba

SHA1
e713829fc3a9e7557987e9e151f5cd2fe26ce0d5

SHA256
22d606d49db3635243f9dbe430e5019c4f670c121e3aba99249361f0e48e4a57

SHA512
92cec3a65efb363c56c24218178fc2ed33ef91f1f1f866b21e8fa92a6d64dfab77b0d36b9d26e27a3f8eca85d92ec8dc05a5d3100603c63fc909b2328cc3fa0c

Download Submit
memory/2536-32-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2536-77-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-20-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-21-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-22-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-23-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-24-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-25-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-26-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-27-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-28-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-29-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-30-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-31-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2536-33-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-34-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-1-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-2-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-3-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-68-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2536-72-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-78-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-19-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-79-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-81-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-80-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-83-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-82-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-84-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-85-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2536-4-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-5-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-6-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-7-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-8-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-9-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-10-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-11-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-12-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-13-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-14-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-15-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-16-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2536-17-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2536-18-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download