74b3b5feeb2d9a99d53e40415c4d6d943760f2250920333948e8287634d4f09b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

417c81a6f342cb5e9ad385b750feea51.exe
Size

100KB
MD5

417c81a6f342cb5e9ad385b750feea51
SHA1

c6943e7ab177039149cd1dbc875509f8cf7cbe97
SHA256

74b3b5feeb2d9a99d53e40415c4d6d943760f2250920333948e8287634d4f09b
SHA512

16881880450adb47259ba221ca1edf43f8cc8c2c7d794146c395229b44eba8db0fc195964d8a0fda6ca3a290fc3af94be6c5fe95533c607ddad9f244072a2411
SSDEEP

1536:MkcUv9Wrw3h3FA2BJskRMbBLBZCx5ywyTjcol97NKRxWMZvbNV5LtL3H1i1:1d9xR3G2BZMbBLBaYw0coLujNH1H1i1

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stock Trading Pro System Trade Stock Options 70 Commissions.LNK	417c81a6f342cb5e9ad385b750feea51.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Stock Trading Pro System Trade Stock Options 70 Commissions	417c81a6f342cb5e9ad385b750feea51.exe
File created	C:\Program Files (x86)\Stock Trading Pro System Trade Stock Options 70 Commissions\Icon20112011114356.ico	417c81a6f342cb5e9ad385b750feea51.exe
File opened for modification	C:\Program Files (x86)\Stock Trading Pro System Trade Stock Options 70 Commissions\Icon20112011114356.ico	417c81a6f342cb5e9ad385b750feea51.exe
File created	C:\Program Files (x86)\Stock Trading Pro System Trade Stock Options 70 Commissions\Stock Trading Pro System Trade Stock Options 70 Commissions.LNK	417c81a6f342cb5e9ad385b750feea51.exe
File opened for modification	C:\Program Files (x86)\Stock Trading Pro System Trade Stock Options 70 Commissions\Stock Trading Pro System Trade Stock Options 70 Commissions.LNK	417c81a6f342cb5e9ad385b750feea51.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
2728	msedge.exe
2728	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2728	3292	417c81a6f342cb5e9ad385b750feea51.exe	91
PID 3292 wrote to memory of 2728	3292	417c81a6f342cb5e9ad385b750feea51.exe	91
PID 2728 wrote to memory of 5072	2728	msedge.exe	92
PID 2728 wrote to memory of 5072	2728	msedge.exe	92
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 4932	2728	msedge.exe	97
PID 2728 wrote to memory of 3192	2728	msedge.exe	96
PID 2728 wrote to memory of 3192	2728	msedge.exe	96
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95
PID 2728 wrote to memory of 3256	2728	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\417c81a6f342cb5e9ad385b750feea51.exe
"C:\Users\Admin\AppData\Local\Temp\417c81a6f342cb5e9ad385b750feea51.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.chrisqueen.com/cb/1PROSTOCK/program
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef84d46f8,0x7ffef84d4708,0x7ffef84d4718
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13260465800120608701,11368403302193291703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Stock Trading Pro System Trade Stock Options 70 Commissions\Stock Trading Pro System Trade Stock Options 70 Commissions.LNK

Filesize
790B

MD5
3f6d55ebb871a445defe6957c79d6b40

SHA1
c082850bab9d898e7591edcf27695a3993af5528

SHA256
0e4272f719dc71e83696e4b1f34336567641933f4bfa1606764e2e63b867974c

SHA512
7ac3f240676260237122b18431860532cb708d88c2d28cbe38788573c25c35d116884705392e8810eaceb0a17dbd5c3f2aea8fe0a3f72be3722b9941a952d9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
8344f7d351e33fb699cbba1815a278dc

SHA1
5675802cbfce86c2d5b67bfb6329996eecbb046b

SHA256
70685840f747ed14cbc34009ec449f4ea09567520818f6f95b1e58aa70c126dc

SHA512
3d435d98785ce1a73362cbb8b0049fe9a29f851eab97e422f2f071bd27581fd13e2335f78339912379dd2b494ab333ca07c9433d76a9ab021fbf1992e787c903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9a6822764f6ffbf0a32dbbee1d28be35

SHA1
605aedddfe61f758ebd0b1906113cc38f2276ebf

SHA256
2b6815a2486af6dda23759e4d10eb9219b98d210a3d1090963b802c599990c88

SHA512
d5c4679645aaa44cdcc631d517ccf0f9e6c531c54c3977e9da061278f27818cf2025fc653145d3762b9afdf0b536ed04759c9216ff448dcb68be7575510d2275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
283721279c7c1e45d1d43224aec3a963

SHA1
28a0f7f7e4f5f7cafea36acc428b15a6f9b91c8c

SHA256
b8ae4fe6bb9c7aad2d11519d73d73fc8bd14c7e61b95b54a507dff7c76d4d0e7

SHA512
7bbf48a4de2ec19706e6b775e16a6ae1e5240fc48d49d2194367b0768b333c43f2874cef9647003e0efa2daf31ed3d91fe4e483b201fa90833b0b4a60b21ab79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b375e28e8a13a7ed80d1e6cdaf07faa6

SHA1
8cea2f08e2aab0c62be2aff904ded294b6da55f1

SHA256
4ad0e78ee4f9ab6ba49e4b68ab23bbdff72f04714c503613a3c5cabfbf37dc75

SHA512
ce1eec1ab97a991fd2d8f2c751983a8eb352026a126579b82a0119b94aa4c4f3aae1941e6668e9749a908a91114c76b09081a616b66d5a54f2a7ca01e1c70d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d790879c202fa53cd83f6be7cd17e13

SHA1
a212721f61f9e051416ea9edc2131141ca0d843b

SHA256
8a7baea307f9167e0fb6bf880b952fe4c59b550af0c71635954fbda57f1b59f4

SHA512
8ebd14f20ca15050b1247fbf3f0081ae0018904a06e1fb3396b80e4faa9f7e514d0b202f867ea5d353b50efe3d114b6d7a591afc7185d5719fc26b912b704d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5247396ce25a30fe6c48b8881795e013

SHA1
a9514eade8aaee519bd0277671c2f05609c896a1

SHA256
d8a079862648004fed8770f1ccea1d6ea90ededa72311675dc96730e54a935fe

SHA512
2636d16ec4584d17f9a9b0449e56ac50b8e88da605f44c60f907273f80a8799556a754fc8df63abd5c7751e1ccd541d99a777a932954a12d1571870d650f4302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e59d.TMP

Filesize
1KB

MD5
20d191ecb5d3d2761250b0902b3deea3

SHA1
70493a84088dcdebb397c892361ce70b54b542c0

SHA256
3a35e246068e8b9fb4a56777c20df32813f4622410c1c4ecb70fb8b3b1e4c692

SHA512
b9f1a1e445d75ee722068aa4ece993a3dd39144cf903e25a2cf23fc42be25210a862c8c01ed73782cf20ca947c7af437ecb51425fc32e51e6aaa01323c19b154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e055d97f-0230-4e37-9f9b-66af0f12e6a7.tmp

Filesize
7KB

MD5
21dddcc9682892a8d13d13c8ae7f49d8

SHA1
71dad37ee8ee577b1187046342a90dbc50f86ef2

SHA256
d2659270cd5875245510139f55fb89bfb104bb69b42018556bf6821de7cf89ac

SHA512
2ede6f078205626511c6325f413747be7f2c1dbd421049ed115ba62c1c6826464d6ec552b9c8888518692b99cdd2afd43d0ed523a83c37b97c5c577aa3e964f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
efee391fe50720dd8b7fc4fccacc537a

SHA1
2d5ac3640a4fa324d6aded072026cd84af1ad187

SHA256
0104794e732a2e91adef25e9586dd9e48f4b7db2c027afcfde2c999cc412320a

SHA512
7716180cadad6f1ae5f1ea6804f5f72ad2e950c28bea5940eecd8aacdfd0360b9ec6e4378336d0c2a1b82d4cc1c13784aecf0b17e85319b52db57f2ba7c40118

Download Submit
memory/3292-51-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download