hxxps://github[.]com/Netaa33/KRNL-Executor

Resubmissions

06/04/2024, 03:27

240406-dzvt3ahg7t 8

06/04/2024, 03:23

06/04/2024, 02:55

06/04/2024, 02:53

06/04/2024, 02:31

06/04/2024, 02:28

Analysis

max time kernel
61s
max time network
65s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/04/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Netaa33/KRNL-Executor

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	camo.githubusercontent.com
20	camo.githubusercontent.com
21	camo.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Installer.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4740	msedge.exe
4740	msedge.exe
3004	msedge.exe
3004	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3104	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3680	4740	msedge.exe	76
PID 4740 wrote to memory of 3680	4740	msedge.exe	76
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 664	4740	msedge.exe	77
PID 4740 wrote to memory of 4880	4740	msedge.exe	78
PID 4740 wrote to memory of 4880	4740	msedge.exe	78
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79
PID 4740 wrote to memory of 4588	4740	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Netaa33/KRNL-Executor
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb56d53cb8,0x7ffb56d53cc8,0x7ffb56d53cd8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Installer\Installer.bat" "
1⤵
PID:3408
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4676
- C:\Users\Admin\Downloads\Installer\compiler.exe
  compiler.exe config
  2⤵
  PID:4680

C:\Users\Admin\Downloads\Installer\compiler.exe
"C:\Users\Admin\Downloads\Installer\compiler.exe"
1⤵
PID:5056

C:\Users\Admin\Downloads\Installer\compiler.exe
"C:\Users\Admin\Downloads\Installer\compiler.exe" C:\Users\Admin\Downloads\Installer\lua51.dll
1⤵
PID:2492

C:\Users\Admin\Downloads\Installer\compiler.exe
"C:\Users\Admin\Downloads\Installer\compiler.exe" C:\Users\Admin\Downloads\Installer\config
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7499c893-f990-4969-8c89-ae5933f7442e.tmp

Filesize
11KB

MD5
f42737a4e2f40243f65a90baf16d0b1c

SHA1
a5f67611e320ea5b6be57ec7d76b8aabf8691682

SHA256
02df860d555925fe0f96529c6d356690afa64c98c50ee6f18d5e92ebdd2c3634

SHA512
7fcbceb2b5778db35670dca75bfadd246df6bbc165698afaf20af66f955ee6cb6bef728126e666aa6b6aeb3cff928cc0e8ee4d08d058d059e7eccfb0ed5e3bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4de1f797c984af1b280b577ecb4a7494

SHA1
d79c01e1236ba81eabfef2ff993244a89b831183

SHA256
1842c766983131f724db7a2e97ae72fe1b927fa1d49cf05d317b80946a2d448a

SHA512
ed8eb645cea40a2299ee86ac1f7e02f5788893634e0e0fec818b46b602084ba01f6829c91fb6e35c3215475143efe25ee26e166ee9a7e958e3a8a378b8506fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d25a5a6f01580ac256eb8c34b6a0ab0b

SHA1
a9a421fe20fb8e9a17520ef8aee32316356d5185

SHA256
a1f15a991a52edfbd40e9f6611aa656b36d96fe4826ce9344b299eed82fafb2d

SHA512
035a60f28f0680de1b9e43f7b0628a54186d89a434e52e490f3925e35656a90c78f9e5a9e756830f7f713765ccc0e5bf2ce1d2f610dd2dee79711898561ec3e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
006d71481354cc6098fe76bdccf99d33

SHA1
51df0c747e0eb9d2b4fc33d886029ed4d6a7e533

SHA256
7316633ec356c53eac0c7411a0270542c1a5572950a083339963203b44b9aaee

SHA512
c9c5e4d030b55fcff030281c0272293be4ed45392f88d669cd19b81db9b7087f0ee2d313af36d37f708c8d89cdddfd8ff72b232052c182c8170bb3a14fca0bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
40bdda4158307f323408d5bc47952dfe

SHA1
6d5973f8ca5c9d37d869b7390100eff9657c2851

SHA256
bb866dd3fa2eeb4d425931095420197b5b1d0ee656c035de476ad5d3d97d3095

SHA512
65405ee1455287097ae91d402543b0b97088de028043ff1114b7937c7ed0c94963b62c15cc31da8f257bd98ebb5a9772fe4c36ce200d4ff8315ea10677ceb120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c256.TMP

Filesize
874B

MD5
56fa881319678f17b51221b50eda332e

SHA1
60690f62eec6474cf98360f471190be09f5e8da0

SHA256
4f2b11b47ada30ac70335999b879a2a56069504a9b241437cc3bc05dd4871ec7

SHA512
5f7edc2f33267ff35a39e82029c9bffeb1769646597814f4607ba91d979382a4635c222a4a3eeb4efc2903da78236c9da13008c8cd0894076bf4627d5dfd80cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1db2bdc3f0fc09b5e2d4e04c108200c0

SHA1
00f911685acf55d9f70185836155a711302f9e0a

SHA256
2ac6f914902059210449a8d77e11e2e8480f09c85a8155d525475cc3061e01bb

SHA512
4f0751becd398f698fc8298e167d8d7490f485e8ce614efa420bb71a74f5578e7d86bc32a6cd8b54266eaf61d3bb4fce2ab050538072be913a9d20205bb061b6

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eebfb84605e05222e3ad98f4b9f62db2

SHA1
36ddd440df5b2776281ad245a6a57e7a183c09a0

SHA256
4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559

SHA512
90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6

Download Submit
C:\Users\Admin\Downloads\Installer.zip

Filesize
476KB

MD5
9bda27c2159a36fadbbb4b073eb58363

SHA1
e1c38a62e2f7efc3ce4e0a3c81375f8fbfe36826

SHA256
2eb959e06c121bd6ea9e5cc6edb280aca21344837f653660f5c97b46efb97793

SHA512
195ea7bcbc412a2ca57c5bfb1090f7c378deb77625efd7ac590cd0150ee39fa1a85dde264f270e1d9621562ab16db0366a019d5ecc6340b447baafa2844fbfbd

Download Submit
C:\Users\Admin\Downloads\Installer.zip:Zone.Identifier

Filesize
624B

MD5
1afebadc346c78290cda580f675ece45

SHA1
5539564649a0da40b3615fa36a2658b5ea9c2e27

SHA256
51e0d629f05ff274bf0d31c5284630d9c9020f3015cae114d36efa39db1eef0d

SHA512
59ed5b84b51c1b7a36063c85fcbe45f4148798eede696129a95fb4517ed8b73ff3dd29ae5fc5531fbe312a99c685f95112d0add80b414eef2c9825cee4a6ea84

Download Submit
memory/2016-631-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/4680-238-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-247-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-213-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-222-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-221-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-223-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-220-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-218-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-219-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-224-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-217-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-216-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-215-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-214-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-225-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-226-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-227-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-228-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-229-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-230-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-231-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-232-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-233-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-234-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-235-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-236-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-237-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-211-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-239-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-240-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-241-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-242-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-243-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-244-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-246-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-212-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-245-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-249-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-248-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-250-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-251-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-252-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-253-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-254-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-255-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-256-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-257-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-262-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-263-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-261-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-264-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-260-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-259-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-258-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-265-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-266-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-267-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-268-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-269-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-270-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-271-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-272-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-273-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/4680-384-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/4680-388-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/4680-389-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/4680-399-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/4680-455-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/4680-210-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download