81888a2655fd6baf41ba46af7afa2685c297013724d6feb5ef2e66792c886200

Analysis

max time kernel
121s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07-03-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download_aurora_installer.html
Size

25KB
MD5

66758af4e2a99d02de7ef35535585891
SHA1

46bf2c562eb1681e2ffe956667259ff46926bc3f
SHA256

81888a2655fd6baf41ba46af7afa2685c297013724d6feb5ef2e66792c886200
SHA512

6e94e5183f6142cdea48ddb2f29736b3857f68190da73cb14a0f8d2e9dc15b69453d95e3a52e3abe02d122af872fc9b742211b27c6bab3e67eaf88c86a88bfbd
SSDEEP

384:7v3Ni5ipQC0npYjLlNyRGW4DTMSnW7M/VsLS5:7vMA60LlNfHAS5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3212	msedge.exe
3212	msedge.exe
2052	msedge.exe
2052	msedge.exe
4796	identity_helper.exe
4796	identity_helper.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4252	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4752	3212	msedge.exe	80
PID 3212 wrote to memory of 4752	3212	msedge.exe	80
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 1332	3212	msedge.exe	81
PID 3212 wrote to memory of 3692	3212	msedge.exe	82
PID 3212 wrote to memory of 3692	3212	msedge.exe	82
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83
PID 3212 wrote to memory of 3780	3212	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\download_aurora_installer.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8edcc3cb8,0x7ff8edcc3cc8,0x7ff8edcc3cd8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,17260604780134023788,1755148734710128021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
4dcce59e916928a3c2f832d1a4fc1e93

SHA1
1ac82684f983f448388674d30d5f5e6f148b47b9

SHA256
73d7791367339fb426c1d2c2a89730ed8af4fcfa51f45fe5a29c864eed2f2041

SHA512
7bce9bcc9ec391fa200f8a9ed5e7afb0ee5be0a9cd537e7eabead5feb3c0bc37aeea8b35b7077268f517253720b809d74809ae9534a1bc88433e01793bc598cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a91469041c09ba8e6c92487f02ca8040

SHA1
7207eded6577ec8dc3962cd5c3b093d194317ea1

SHA256
0fef2b2f8cd3ef7aca4d2480c0a65ed4c2456f7033267aa41df7124061c7d28f

SHA512
b620a381ff679ef45ae7ff8899c59b9e5f1c1a4bdcab1af54af2ea410025ed6bdab9272cc342ac3cb18913bc6f7f8156c95e0e0615219d1981a68922ce34230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
601fbcb77ed9464402ad83ed36803fd1

SHA1
9a34f45553356ec48b03c4d2b2aa089b44c6532d

SHA256
09d069799186ae736e216ab7e4ecdd980c6b202121b47636f2d0dd0dd4cc9e15

SHA512
c1cb610c25effb19b1c69ddca07f470e785fd329ad4adda90fbccaec180f1cf0be796e5628a30d0af256f5c3dc81d2331603cf8269f038c33b20dbf788406220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
eba145aa5655632249cfa74bfc045c1d

SHA1
a8f2a9523d36ac3e2cb721136d523edbfa144750

SHA256
41629080ebdffba4370a59d6ecb31bc47b8946ef16daedd60fd94d540caafa6f

SHA512
06ae90ca0f3544b2a76dc1fb4ce416e4aba0d04f456b0ae175200499104189e1521700dd53c65f802de00e2df158972e3c305d59ecbfebfcb6f854db8c2004ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7cdcaaf513645c942272e24b083280bc

SHA1
dbeb058d767d9f8e3c4d66b3870dc0220fb95c84

SHA256
3519f6702c5d8939a41565172497089ca334ea3e86f55b439c5df10cd283dc54

SHA512
a6e9d07a3b6317d879a10f6e3541437dd96127d428c0d9000c304bd909cd62b6ee962775b6b8f3fa39724069adc243e81d811d7e5081bf0490adb3a693293ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
62780e6a52506ab0eddf3e07d5bdb244

SHA1
426f21b11e7a3d02bd930d5e0998b5bc25a7235f

SHA256
b8793e49d8ee28c507b2337e5c1c1fcd5998b950bd4bce666425f949cb2c5fe5

SHA512
d134da342be7cc9790e55e2109c8521b399ebbf2a1473f87ffa182bccd2b020bd668f5d77c17286319813e05e35c8ba3d4be22713cb1d8506e27e221a22e796c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2bdf466484a3595308739c2bc775e117

SHA1
6a7dd453805de19e2cd6d560bcf26a91caa90715

SHA256
d2731fd8d4a92abeed0198ef441a0186e1973c020e08e64e055c33db9fc774ee

SHA512
8c4d5f7486fd40278979fe1dafacd93a81c5e1fd608fa36b7ab3312390829a13694717e0ea92ebfc1abb5480abe9efbd6c90ad179123534473ac209676020d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
deef397178fd211a14f3d8d84603ddce

SHA1
3ea7a0e10f55402f024c47420d9e4d1d5068eb32

SHA256
1d2ea63780ba51ee03f572940989edd2bb81959d101213fafbdefb188fb66ca9

SHA512
a52b70ed9137246934dba2b5f798e768dc1d68e26c8fc5a34ee6eb899356fc8612cb8281976ba421f0a0defebdb3ed6a6cd6701e45cb1836d90f804c4e9aa484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
902d6b35ea5e2edb390b51b776a5cc05

SHA1
ba38d9649f650dc80a21e02a400209a33394d21d

SHA256
a1d93dfcdb817a88e537334b98b881f4d39b470135743d378fac2a2ccd78f0be

SHA512
ba829197439636bb9409253a1c07c781b7da0782d0758d251edc07c585e45235460d5de5de16c33e02fdd886be80507821ba53fa9105549203ab991b8e0ec4c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
1de2c60e1b448fbfd2e47ed2475dffa1

SHA1
216bc752284c33373c9e8d402de6fa844d56c608

SHA256
48b86b299afc752f15cf45922967900d1bc7fe508067f89bfedbc83b174e4d03

SHA512
029609bec81266a2828577723634bb35920f0cdf1c8d3cf656f5a4a00660564928750bcd590c669e470b7f44e5dfb1d6e0ccd42da381af9952dd7d59305d069f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5851b5.TMP

Filesize
539B

MD5
394ef06f38962d82157110892ca9f384

SHA1
25a7c0f5e037974bcd1c56d0fe5c76f1386eb5e1

SHA256
39d6a4bcc0d4ca36549636e41419592ff71985de071c783acb2679a746f13473

SHA512
09e3468e2008463b55de66aeb6ca50ab0a24df9e319d7ca3b8f4bf1d5e8b0d29507ae1cfb0106762c3a2566cdc5daaac27d37fa2bfeb9f36198ea1136eb68c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2198b24bd4f0586a53758aab2e17792

SHA1
c85651593654ae0a533efefc23ebe88a18271649

SHA256
c9d16ec7439a78fb421c44c02acfdef23b84fabe997d17c550793d6d04aeb1b9

SHA512
91e01ba08ae7eb387c9cecf7fda04183e4bb7e4b4e1694c4681b6b083e6a407c47ef50f9b24874b47500e75927ade64c55df817d46eb061ece476c49426a63fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be05163eaf511b3fc82af1eef64578f2

SHA1
9c849430e50c13f870ada27b2cfff8260e34adc1

SHA256
7fbea9988c4a899e0efa4d304327ead1f25bc657062c1b62fc14fe0e6f5d0c0b

SHA512
90c253122748687ecc392ff6d1d3ed90c06f85ae29c951b70d7b9e8e4f58b24f198b94e4085a7237b3ed3c32ff4f54a1f4e91724ea2a551f36387d6981a6eee9

Download Submit
memory/4252-238-0x0000022602040000-0x0000022602050000-memory.dmp

Filesize
64KB

Download
memory/4252-254-0x0000022602140000-0x0000022602150000-memory.dmp

Filesize
64KB

Download
memory/4252-270-0x000002260A470000-0x000002260A471000-memory.dmp

Filesize
4KB

Download
memory/4252-272-0x000002260A4A0000-0x000002260A4A1000-memory.dmp

Filesize
4KB

Download
memory/4252-273-0x000002260A4A0000-0x000002260A4A1000-memory.dmp

Filesize
4KB

Download
memory/4252-274-0x000002260A5B0000-0x000002260A5B1000-memory.dmp

Filesize
4KB

Download