f5f0dc42498d4414afbe66329a1181263a11c7707ffc1f015ce42996041a8bd6

Analysis

max time kernel
160s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44f609f0b8212b47e2af63d40c12cbba.exe
Size

50KB
MD5

44f609f0b8212b47e2af63d40c12cbba
SHA1

63801b3eb605c650f43fbfec864e0c17b3930db4
SHA256

f5f0dc42498d4414afbe66329a1181263a11c7707ffc1f015ce42996041a8bd6
SHA512

e4384c943b9d71de4d78bfa5f7f66af98efa7b05f6da8ce53d5ddba7f74f59a9c75570b580c56a4847647a0487209c4238401351b779b9088bc35c24bfecb68d
SSDEEP

768:54qWkc7KPl1G0zqvq14WdZg648xWdeVHvuX7LvNE0ygFFsG:54JxuPiqYqCWA/NEvuLLDyEs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2200	msedge.exe
2200	msedge.exe
3812	identity_helper.exe
3812	identity_helper.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2444	2320	44f609f0b8212b47e2af63d40c12cbba.exe	92
PID 2320 wrote to memory of 2444	2320	44f609f0b8212b47e2af63d40c12cbba.exe	92
PID 2444 wrote to memory of 2004	2444	msedge.exe	93
PID 2444 wrote to memory of 2004	2444	msedge.exe	93
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2636	2444	msedge.exe	95
PID 2444 wrote to memory of 2200	2444	msedge.exe	96
PID 2444 wrote to memory of 2200	2444	msedge.exe	96
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97
PID 2444 wrote to memory of 2272	2444	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\44f609f0b8212b47e2af63d40c12cbba.exe
"C:\Users\Admin\AppData\Local\Temp\44f609f0b8212b47e2af63d40c12cbba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://voxcards.ig.com.br/imgcartao/cartoes/26/c26_amor_veiodoceu.swf
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe76346f8,0x7ffbe7634708,0x7ffbe7634718
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 /prefetch:8
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6936 /prefetch:8
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7060 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17160984481120144071,4733451438742433418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4736 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
32f43156f8cd04ef3a3bfd62d3626b1f

SHA1
e1c7ca5cbceae6f274ac00875cfdad521eaaaf8f

SHA256
67455abcb947d96507e920aba8db9de760792e3824b4207045cb7f0ecdf862e5

SHA512
cfc46d74c0a2b63838827f0350e961ae60ab46e13244bba54ee6c05d7444b740da022b5c2d51e8fd1dc33e975803af4d4d00d09b706de19bdfa39272c1751a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
412cced5289358240a10234bfdfe6a16

SHA1
5a15a3268a790e3216aa6da3f2e56593bd321c41

SHA256
8ab3e8e1e9c3f0fd799f0ad7f81c2751494aba718eea42eea15ea1648d76d675

SHA512
c8d14f0d9f6725c49cf35d2f19b172167697c9547410cb939e5ea23e2c19982d7c0071ed692bcff7ae0103d5fdb6d2178999ade912832f39b0eb68362d9fccf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c7d42b65a25c164cff754c0bf921d8d

SHA1
00610524af734ed16ff1bf58af8c5d958318627f

SHA256
13ab8cab4792a236feca1a663ce59a5b27349925d6e419d8b7a524a6b85e19a8

SHA512
ff5aa32b91aa3c48d094f7f6f0b128d4450c1dcae56a801da80fb0d03bdf39b7c70e86a1df1c27618434384a41c8fe65b3ac8a11e27b3456d3a6cfc288daa11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
564a65350334e4eaef71b4f5020b838d

SHA1
b12b7962fa47419bbfa89b1eeab87be2aa751632

SHA256
5e8a565418735270e1a853fcbd2f789ed0359ad82f35e3284d3156f2f6fac97e

SHA512
56ff01f8fdd9f78927836a9d747f49afd92dcc17113aa38c1fd5a21a84bf26d215b3a1be7ea381b6b2fbba4c3eb44b296da492fde4f459dd1fefe4700ac85056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63209827981a29baba2efb9fd99149d2

SHA1
1526089c6021cc409b3e44c9e4f02e2f286f8a68

SHA256
f1890913e4735b19dc54ab6812fd7c2f20da693df8a5c9508b1e8393f64ddc86

SHA512
40172fa7d3a413e482efdc40cc09140867c56d0ddf05768d332b3df9986680e9069343819173e727c1c2fa0cdd5213f60d483e80daba672fcd7cde036c6c86af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1f6d61d4791387d790592c267222c9b3

SHA1
9e422a8c8465077e1ad5cce05408d2cc25d8b0cc

SHA256
d1422d0a143b274e3d892a6be19cee1888e180de5f64b1d11720333d48c0edab

SHA512
6598af013b8267f5a8d620ee1a9f039613d6c9bd45d1a980698e0ee689250ee4f185d0999f45596c71b49f0a97fc6176bcef978e3dc509126e23ca1c682f11bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
0eb7d8c6f5dc1139235b6f485b1a91b3

SHA1
102a7821308036c1b9854b6d7b3671a63f65f82c

SHA256
3b8bb9f979ee027105571e02bdac08baadeb4aed42b44bff7427d3470b99d9cb

SHA512
bb104917861d3aa831d4084429a52c9b82273c3964a42140df13a685217ef6b3b185b7fc090a5ce7d99715144e114fe113d1f4dbd1c107ea9370dd48f47c8ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2703bc1ec94a5d0ac5ae97b90064896a

SHA1
ce6ebcdd2a922fe518cc3dbc404714c7dd71c307

SHA256
8d5a446083872b50345fdb958b90105d60a5265aafd2ae19e9ee82916e409933

SHA512
eb6fac223cdc87e7c5b5e3c3ae1fc9d9ca70659d442a94e36b856b645c2bbae85189aa8538a0e01fcd649943fe2f22ca8e3b2c5b809a2c29e6b789e85e50030c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1d907e923c6485695f8a9f134c9d3b55

SHA1
dfaa0543bc4dd6500224386a7a62a119215dbd3f

SHA256
a024a6132295cc3c2cd0b2f0ac6881b4fc9ae7b858b3ed253de35eef06eddbcd

SHA512
6357818f1bb26858853fd764e406dcbe24e3862364073dbee031a087bc4ad1d63652931d33b50d838ab316616907d9fef29b985b00b55e75ede15e444bc1b9f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8c86ca1b4bb6824c7c40c0424ae4ec6d

SHA1
61a24bca00129adba8bf4452a3528313898babc9

SHA256
ab7afbc88d250e34a42321c58763882ad349ed1689de0cf082bd43e4b3c199bb

SHA512
bd81303536e934535960ca6cc2770ce49c6a8fd78fab97a455aae275320e77bbde2b00bb791556050ab1f2c4c34daa37836d4cbbd6429fa33f292ca5671116fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2efbf8fee2b29d8ac9744de7f4ead0e0

SHA1
16baf091e2f8d42918f3eed16330346be0dc4ecd

SHA256
123e90e30da4185c04db7f454840105c4b99618c9ebb21c39e619dd391f83005

SHA512
53cb7f994a300cc0e02216d64df08bb1335c916cc9c8da09653eabd5ac4f38457b56ebc922fd3d370c024fd13235dd17be3d6125a665c9710dca694ce52f5457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58fd18.TMP

Filesize
706B

MD5
64ca8fc379fb66cb9a125f8de9198d65

SHA1
c888bc4070f4b0b7d522d1de3493563c9926cdc1

SHA256
149da25e549cfb4b9f0ca41c899322fc2f1490d2d8f13bb512c983b315f761ff

SHA512
d1c18e8aa369fbaf859c309f4d5b6c75cbdbb9d90c1a90c33ac6b52b520720de6e4fa32399dced862968a4b1ca407e40cb035d3101e310af4f261ede644ba6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce43ada2e12414ae5cdcbc004e37f343

SHA1
e27fcabad7090588ba9ad3a1ddbb7172ce063a9c

SHA256
3e678777643295a14c0f8fbbac9b24fb6d938a12fe2930eb2c6f6680f14ddbc4

SHA512
7f8f3d9b2d6015c9d1aacf77e5c40c829a3157a9238cba1478565212859156fba5d00dbb778b0dc61141d25b4c78ba4ffd6fdfe8f4e5b7df2536266399356826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25cc1d00f7a650a4849332540672eb1e

SHA1
83a007c5dab20595cbee86f95e517d7bbb392584

SHA256
5dc647a058187b727e7432720f9158f21d73d77f76aa7995d03159c3a9ae1841

SHA512
5e34d2755930013cafba9300d351bd0abebf525932661dfb0d6af8ba112f7d9c161810995bccaabde1d4bfea92e0800741f381e4af464b3f245edc9404fc1601

Download Submit
memory/2320-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2320-35-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2320-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download