ff55760682fbb9a0ff4ce6dc16e6b29602dd85c9fa094b9b08a5aaf7a1c28d51

Resubmissions

06/04/2024, 12:38

240406-pvestsba58 7

Analysis

max time kernel
2688s
max time network
2621s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Free Limited Version/BrutoForce Seed v12.6.1.exe
Size

132.0MB
MD5

d94d918b7180204d515cc56978f1e251
SHA1

cf2ccae0c51e56b85b39bd03f9a02526c8757a85
SHA256

baf1ff994d4398644013cc69f2c24a1c0c5c39813e5e509997606d3ca0e3a6ac
SHA512

02a9ea87be704894e508ed96d5c062db0c9b733d3829629ca467c5e411393f11a07292ffd3f7bb308e52755a02f2ff960342721f4939a2932a5f16093f45df72
SSDEEP

786432:hWXgFwA3WzNQXBVBEEIVeHDWIBV0aMoSctbw17p2NsBHae7XRYBix72TtLwSTRpJ:hWawcvKeh0ew19S8ae7XRuiRAhN

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	BrutoForce Seed v12.6.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	BrutoForce Seed v12.6.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	BrutoForce Seed v12.6.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	BrutoForce Seed v12.6.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	BrutoForce Seed v12.6.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	BrutoForce Seed v12.6.1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
35	pastebin.com
38	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3240	msedge.exe
3240	msedge.exe
1204	identity_helper.exe
1204	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3168	svchost.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
4480	BrutoForce Seed v12.6.1.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2716	3240	msedge.exe	95
PID 3240 wrote to memory of 2716	3240	msedge.exe	95
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 4536	3240	msedge.exe	96
PID 3240 wrote to memory of 3220	3240	msedge.exe	97
PID 3240 wrote to memory of 3220	3240	msedge.exe	97
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98
PID 3240 wrote to memory of 4000	3240	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
"C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
PID:4480
- C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
  2⤵
  - Checks computer location settings
  PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
    3⤵
    - Checks computer location settings
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
      "C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
      4⤵
      Checks computer location settings
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
        5⤵
        Checks computer location settings
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
        6⤵
        Checks computer location settings
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Free Limited Version\BrutoForce Seed v12.6.1.exe"
        7⤵
        
        PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcdb746f8,0x7ffbcdb74708,0x7ffbcdb74718
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,4621332307392481646,18059349561243208850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
3ef4e244c5f1ff271c1832074a5f22a1

SHA1
43a9f556f912f0c30c15f959231ee70f58f030ad

SHA256
fe2b8ee04c9331a1ace2ea92f2f56b2b77798cf0974a38327dd19df8bf176675

SHA512
dca9f8b7f809e162c243fb26e795ce2ab639d9441ddbd650e6981e90935aa427b893d259abe3e3aa2bce90594139e1f372d1170f6eb849c7f49fe9ad7a6aa14f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
62be9705ff3284928b06526611b059f5

SHA1
082932fe0cc5925a65bcf37f3174cae33e3ddb73

SHA256
bad815b60abc47ad2722dd87c5ea76b1fc28f2b4abfc0fac3fde532f079e17ca

SHA512
f45e07bb7dc11e2e0ec569d6ec606c021e491a2ec762f542348bec3de9ce8d967bb3f190b768c29f57b82e4ec55149f0d1d7c3b1ec80abf6c7aed382403944da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fad37be7e5146b4bb42bbbec2fe5590

SHA1
112851e6a4a9b4b39d0fd59947668ae553f5835b

SHA256
25442f9dc491add80a90a66b09414550a73942c79e9a4f903bc0a0163555ef24

SHA512
19c3587056660cf923f5fa21cacf57763f05add9844760d2ca283e395c46562c6d760296cac3190dfc31841897ab7dde05fd01e3a9aa2d630c7984d9d4e14752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
662c51fe0d7e3b8fd49950de5d5824aa

SHA1
37c251cc8c9cc2d721d1b742b1903474e6e42d2b

SHA256
bd3c8c4e53fbf861ba584afbe5502b51235cc16b2cb6a77d1d90a3e2aff0a928

SHA512
697471e220730ff8ab9df4e6b5cb6f8d9cabb7c57a1be5e5d7fcdc906574e97406826cf507d57da2831b2e6918d3974dcc3b66efc986d8d0a7005bbe849a9e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3e4e18a02f52dd8b032bfa5bdec61ab

SHA1
f8f5a69390f9fad8f4d0d10e40a3a84c1a1dfe09

SHA256
8e5253295062c4e5650267c5457b95e39a582f10b9c44aa6a27d5d000109cc13

SHA512
4f661ec0cd698042357ef88adc3c227c995bc87f518e1c74a537ee97002e714d3f1869e35276de6b77491e8d1c152c0e26f338cf35880f1da12b0a9117b63a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
122bb4bd21013608b0ad3fb6b2d89354

SHA1
e5565fe115bd1124f0806b0425623ee837713559

SHA256
46ca66a605edb5864c3870eaec89e71a6e718e86a8e9f29e54d579bb02c7b9b9

SHA512
8998bbb637e2d12d9f07c4e0769d64f909b01dca2353ba245fe2def1d330e8d93ca490958cb8079871149ed81820cfdb22d68214ac6fc99b1bcb9c52a1de096b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7821bc39ffd57031db23e5dcf87682a3

SHA1
f29b8af1cb9fe17c2eea1d3e8649b960bed29e68

SHA256
4bd8739abfee2ef20f96edcbd1e7369f52fe792adb15d78bb83d2995774ecdb3

SHA512
3db7bec26992be2a0370ec8fc97849d4485a29896b9e3e7021fee3315213b2b178e3a2c3032b0e578c7b6ad3a1ab98d7d007fe23f8de14ec7725ca3d6ec233bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bb8ab036e66f0f034a1de93b25e134ca

SHA1
b166df076503fcc5f5ddc7c4dbc5f2769bab71f6

SHA256
fe18bba24b2aa20547e0bbfd4209eacdafcb438801fc267db4ffa31e878bb3d7

SHA512
931b14e6778a25eb8022403fa7baa84bff58bc3da5d2cc81a1893ac5fe739d893bc74632f532c1b6596d388037fca31b4ae89c2811ae3aeb0505c484e1ffaa89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9f727a2999af8c3194a5b63d60a56f0a

SHA1
7f40b1f4e64d82fd8d9496451b449854eca1f9a7

SHA256
7408bd4611480dbc0226dfc7d7a994db5b7846e5debc09fbf888432773ead926

SHA512
f4c8ddc90b6ede526721cbf0c3d95715a20e8147362020f8f7bdd82db1903f2031cae458eb53484c962b4480515391ec9bd607d0e17fe6a506112c43bf45850d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f74b2c377e15227ba7be24270c9fa994

SHA1
964c0a6764f72f97ec9be3c26e673a3681a0c5b0

SHA256
f50edd0f811f4149ecb9da330005a9e80e63f37d1d8d3ae606630603b45912b9

SHA512
c7c0e21281007a3c79166249b232345a50bbf39ed6adacbb87ede379b8fdcc079fd9a231f2b03f85c5be97683a7154054effb659e6e0a305f9cdc36aea3bea6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e412e2eead4bc90448b261611afef7c

SHA1
58eba31139a49595de0101a588268085ed8d4f2b

SHA256
a43807cef47daca3deb4d4d6a9223833d6435ad34a3bfcefc408f391f55f592f

SHA512
f1d5838a2f628e4ec5ae2a9b0e70bfe764ab45b4818de1206af9462b826012f2ed5af980645c7a907c83891c3a1e8d5b6c0dea25f699d707a28fb959a165f901

Download Submit
C:\Users\Admin\AppData\Local\Temp\Free Limited Version\License.lic

Filesize
247B

MD5
d545d89e0a0d3ab512be347d8014d2bb

SHA1
f04ee9b661cfb3024467a238eb5744098b4409df

SHA256
583af66c81555e62b7112b5c122a783a587da02c952824eadb21b729cd709db5

SHA512
50e333e4a4f96eb2eeca39031ce0dc53bef7db0c088358da8fc7d89156c2176ac39540cda60baa64c9738d5f47ba7f031e708d6b55f0aa0937dc2329c6999b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Free Limited Version\License.lic

Filesize
41B

MD5
13adba1f2b2c1cd35be6381700e83918

SHA1
12b25ea05c6a4826baa438b138ba9179275c6fed

SHA256
40349aa42f525c4e984da0f67a45903d36434e6fe1b3d59b40769f606d3a540a

SHA512
1e64660149a42cd8971a737c3e34c2b7deb05b668e70c3ee0b86d970213d1f047294caf48bdb37624be3a741f062f80a1bfaccd4e69f38b406c98b81303e23dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Free Limited Version\License.lic

Filesize
82B

MD5
f9d2201dc8ef328fb48bc069ffccbc6f

SHA1
9702f43de6c5d78d0bef0c3e205588d8a8033771

SHA256
ad6c8498b778a3be516f220ba734fdf313a29bf56a111ef5674dcd63533ea5c5

SHA512
0799505031bc6693b5d164841965bcc8baa4044336cd1cbabd1296380bd319a4a6c4a0b84d1fd0266cf7e0b1f200ea18a91bca08c31ca7435752afe009bf2dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Free Limited Version\License.lic

Filesize
123B

MD5
2450ac656e9156eafe2d0b226896c54f

SHA1
877094eeb6d6cb7680586713fc87fc5f9672e09a

SHA256
2d02283d5a309588dd6d9dd6ca094c6154c3f964ddb9588f7a5539cb34c3bc7a

SHA512
0425465c5c2bf602d3efd7ffe6016b33cbcc7be20695767fe2923d0298ca3d1dd11abe1188034d193321168c76aafb5eee4941ff2858253cee71eefc335fa47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Free Limited Version\License.lic

Filesize
164B

MD5
8842db45d30bc5a30330279d55242f7c

SHA1
4fd2d600decaa28e8afce1087a2edaad9d154f71

SHA256
905c956e2f3c7465378017f050a80b12ab47c53bd186906b6983d766cf3a26d0

SHA512
d4f95cbb988bcd194de23dc382d1e11ecc227eb159d12748d28859f013b096486fa98b8f6c3fa3fc79ab88f254cea78f5e0178d9679980d263bf2a07aff62398

Download Submit
C:\Users\Admin\AppData\Local\Temp\Free Limited Version\License.lic

Filesize
205B

MD5
c0198687c3f2a6cccf0758f8cf36b5ae

SHA1
1ebdc6ce117add80f08f6f929ae8851c113f1181

SHA256
9ceda773368771c683a42bc2ad832c6502a6a197c5f454bba3442dbaea2908b2

SHA512
44facece1d5de83ce66705c023cf7fa7a1aa5ba1e341d0f063ea7f2d3c0f00cb5a8c0a4b2bb7af424f6846da9ecef08402e8f2f878f2343ae7993ddb2fa0b056

Download Submit
C:\Users\Admin\AppData\Local\Temp\ggtfmfsy.nl3

Filesize
474B

MD5
46f522c77d1a514703a7fed0015fc623

SHA1
ed22f0a5884ff7445f4e171e1e49e0af608e0fda

SHA256
240098e7033b5f20c8c5936ecb68cc1049f1ecc34af536995b52a93175249150

SHA512
09aec723bf6f79c3926300c64b9b70f67d7190fcb75d53b32ffd2d4803515dabb014cab50cf2924a366c0c73ac2187c4a393790cdf3d4b989146f6b310d3c90f

Download Submit
memory/1848-958-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/1848-1113-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/3500-522-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/3500-663-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/3712-214-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/3712-379-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4288-810-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4288-954-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4468-384-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4468-515-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4480-27-0x0000000006BE0000-0x0000000006C1A000-memory.dmp

Filesize
232KB

Download
memory/4480-63-0x0000000006DD0000-0x0000000006DE2000-memory.dmp

Filesize
72KB

Download
memory/4480-47-0x0000000006D70000-0x0000000006D92000-memory.dmp

Filesize
136KB

Download
memory/4480-44-0x0000000006D70000-0x0000000006D92000-memory.dmp

Filesize
136KB

Download
memory/4480-43-0x0000000006C20000-0x0000000006C35000-memory.dmp

Filesize
84KB

Download
memory/4480-0-0x0000000007140000-0x0000000007AC9000-memory.dmp

Filesize
9.5MB

Download
memory/4480-39-0x0000000006A60000-0x0000000006A7F000-memory.dmp

Filesize
124KB

Download
memory/4480-35-0x0000000006A80000-0x0000000006A8C000-memory.dmp

Filesize
48KB

Download
memory/4480-171-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4480-36-0x0000000006A60000-0x0000000006A7F000-memory.dmp

Filesize
124KB

Download
memory/4480-31-0x0000000006AB0000-0x0000000006AC1000-memory.dmp

Filesize
68KB

Download
memory/4480-210-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4480-56-0x0000000006DC0000-0x0000000006DC9000-memory.dmp

Filesize
36KB

Download
memory/4480-32-0x0000000006A80000-0x0000000006A8C000-memory.dmp

Filesize
48KB

Download
memory/4480-28-0x0000000006AB0000-0x0000000006AC1000-memory.dmp

Filesize
68KB

Download
memory/4480-55-0x0000000006BC0000-0x0000000006BC6000-memory.dmp

Filesize
24KB

Download
memory/4480-59-0x0000000006DC0000-0x0000000006DC9000-memory.dmp

Filesize
36KB

Download
memory/4480-24-0x0000000006BE0000-0x0000000006C1A000-memory.dmp

Filesize
232KB

Download
memory/4480-48-0x0000000006C40000-0x0000000006C55000-memory.dmp

Filesize
84KB

Download
memory/4480-64-0x0000000006DA0000-0x0000000006DBE000-memory.dmp

Filesize
120KB

Download
memory/4480-40-0x0000000006C20000-0x0000000006C35000-memory.dmp

Filesize
84KB

Download
memory/4480-23-0x0000000006A90000-0x0000000006AAD000-memory.dmp

Filesize
116KB

Download
memory/4480-52-0x0000000006BC0000-0x0000000006BC6000-memory.dmp

Filesize
24KB

Download
memory/4480-3-0x0000000007140000-0x0000000007AC9000-memory.dmp

Filesize
9.5MB

Download
memory/4480-20-0x0000000006A90000-0x0000000006AAD000-memory.dmp

Filesize
116KB

Download
memory/4480-4-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/4480-51-0x0000000006C40000-0x0000000006C55000-memory.dmp

Filesize
84KB

Download
memory/4480-19-0x00000000086D0000-0x00000000092B9000-memory.dmp

Filesize
11.9MB

Download
memory/4480-16-0x00000000086D0000-0x00000000092B9000-memory.dmp

Filesize
11.9MB

Download
memory/4480-60-0x0000000006DD0000-0x0000000006DE2000-memory.dmp

Filesize
72KB

Download
memory/4480-15-0x0000000006AE0000-0x0000000006B94000-memory.dmp

Filesize
720KB

Download
memory/4480-12-0x0000000006AE0000-0x0000000006B94000-memory.dmp

Filesize
720KB

Download
memory/4480-11-0x00000000069D0000-0x0000000006A05000-memory.dmp

Filesize
212KB

Download
memory/4480-7-0x00000000069D0000-0x0000000006A05000-memory.dmp

Filesize
212KB

Download
memory/4480-8-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4604-808-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download
memory/4604-670-0x0000000000F90000-0x00000000017BA000-memory.dmp

Filesize
8.2MB

Download