hxxps://mega[.]nz/file/joo3Rbqa#jUDqPjnRsaGTWbGlsvid5g2FsLsL8aKgESZWw5SXcn8

Resubmissions

06-01-2024 08:02

240106-jxmcsscfg4 1

04-01-2024 20:22

240104-y5m2maaffk 7

Analysis

max time kernel
1721s
max time network
1788s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/joo3Rbqa#jUDqPjnRsaGTWbGlsvid5g2FsLsL8aKgESZWw5SXcn8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
1232	msedge.exe
1232	msedge.exe
1380	identity_helper.exe
1380	identity_helper.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5712	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2836	1232	msedge.exe	16
PID 1232 wrote to memory of 2836	1232	msedge.exe	16
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 388	1232	msedge.exe	30
PID 1232 wrote to memory of 2612	1232	msedge.exe	23
PID 1232 wrote to memory of 2612	1232	msedge.exe	23
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24
PID 1232 wrote to memory of 4468	1232	msedge.exe	24

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1a4a46f8,0x7ffa1a4a4708,0x7ffa1a4a4718
1⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/joo3Rbqa#jUDqPjnRsaGTWbGlsvid5g2FsLsL8aKgESZWw5SXcn8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11255899743796208572,833054501522966640,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
1652bed28822c9d234b30628f1dd5bb8

SHA1
0b643ab205699e25e2a82a79eeaabe97611bbff9

SHA256
ed3c41b4b4bb7cdb28755ff236dbeee045bd612f69ed208fdad0afd4cd6d91a6

SHA512
8016b7844507f58d277230ce6853d49c6f0fe94741362dc5b41dbff360f160e3ac3839213b16f62490c4d8698add552ab880b7f141bc077ac47c8c4f6e9904b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c279de9034f2e1578c6f0477d8f3c91a

SHA1
74c7ca59ecc7ce751175c827270c97a443104e84

SHA256
230852ada955d5353fa1d0ec06f7ff2ab5346ff2274f4b1ac7407bac919205f2

SHA512
1dfcc6e2a496a1250207532127d34250eccc66430e149cb90bd06a06d530008598a0743655e3e9cc0a317cf1f37e054a8a531a2de936c8e129b57eafd503f6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7abeba03102b05a76a792cf9d36789c

SHA1
7a1130a52522bc9b71ec7bdb5bb81629be8bf0e0

SHA256
d296cab7514c77587ef961381c984bbf5af68e3fa591c8b5c7e74e005a944bd9

SHA512
bf3f64678158cbbbce41723c8b873867b66cf35bbc333a62b3f1ac9f2f3211c6fb23cee06c6b873c997bd663f4c02205497ae385bcc0c1a3ab7d9133ea9e665a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0f43c06923334d09fdadebf4409e126

SHA1
01077ea9d45c9bd9d05d1ec8fad0249197794921

SHA256
170a7cde36513b3844bc908981dc24d4fdbfd464510dbff15ddb5e161e932277

SHA512
40733d815366d1e4ad0b0c3628e75457972741867b7103bad08727f961d60410f2fddf465990bf59eeb749facb9411dba3a19c5b0446b73e35c6e82162c94806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3e548281b2638b7e48c84b18fafa3035

SHA1
67b5d749dc69aa76878ae6028402eed4234dae93

SHA256
91caa817eeca05f19839d4cab76342c54a4fe9e5064d3e503a42018711c19244

SHA512
37beefeee627826cd6a3d53f8bec6a5f4c574389dd9b7033d3dc62ce850f4253606ed20e74cfe6bb2f98ea0afced9fd8375175777c795c81cb8ff95cfddcd6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581940.TMP

Filesize
48B

MD5
1c3752ad2a45f67326d9f010b349fac7

SHA1
d9be109be63689f6945ed72a21549696ebca11be

SHA256
20178a9cf5516b455ab36cb5bfba8c3052dc5c7ada8d46e64aeb3ee4971f43f3

SHA512
054d45fb7baa42bf8bb502e4f4d8da6bf87e82d0d13a97896016665a85c99a054c68367dfc46e87a802bf9114e74127e7b2467942c4e994cb6d516863baf777c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f45e5f22cfc813962449f66042ef6460

SHA1
1554f8ebd6f1e197ae2523959cac540b32b58189

SHA256
3145c0ad02eadec0d1fd7eb778d86db2fbb29c2ff3cc2afd1aa0b87a1b162c57

SHA512
d1a77954cc6561917f36ab61fe054e4f1825775f0c3fff28e4370057b5990e77d75cfd184d20b6be36ba050be756976b4c1978006de7284ea5d572b799e9768e

Download Submit
memory/5712-283-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-289-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-280-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-281-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-282-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-263-0x000001F8D0C40000-0x000001F8D0C50000-memory.dmp

Filesize
64KB

Download
memory/5712-284-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-285-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-286-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-287-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-288-0x000001F8D9250000-0x000001F8D9251000-memory.dmp

Filesize
4KB

Download
memory/5712-279-0x000001F8D9220000-0x000001F8D9221000-memory.dmp

Filesize
4KB

Download
memory/5712-290-0x000001F8D8E70000-0x000001F8D8E71000-memory.dmp

Filesize
4KB

Download
memory/5712-291-0x000001F8D8E60000-0x000001F8D8E61000-memory.dmp

Filesize
4KB

Download
memory/5712-293-0x000001F8D8E70000-0x000001F8D8E71000-memory.dmp

Filesize
4KB

Download
memory/5712-296-0x000001F8D8E60000-0x000001F8D8E61000-memory.dmp

Filesize
4KB

Download
memory/5712-299-0x000001F8D8DA0000-0x000001F8D8DA1000-memory.dmp

Filesize
4KB

Download
memory/5712-247-0x000001F8D0B40000-0x000001F8D0B50000-memory.dmp

Filesize
64KB

Download
memory/5712-311-0x000001F8D8FA0000-0x000001F8D8FA1000-memory.dmp

Filesize
4KB

Download
memory/5712-313-0x000001F8D8FB0000-0x000001F8D8FB1000-memory.dmp

Filesize
4KB

Download
memory/5712-314-0x000001F8D8FB0000-0x000001F8D8FB1000-memory.dmp

Filesize
4KB

Download
memory/5712-315-0x000001F8D90C0000-0x000001F8D90C1000-memory.dmp

Filesize
4KB

Download
memory/5712-316-0x000001F8D8FC0000-0x000001F8D8FC1000-memory.dmp

Filesize
4KB

Download
memory/5712-317-0x000001F8D8FB0000-0x000001F8D8FB1000-memory.dmp

Filesize
4KB

Download