hxxp://java[.]com

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://java.com

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5788	jre-8u411-windows-x64.exe
3604	jre-8u411-windows-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 750403.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
2336	msedge.exe
2336	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
5556	msedge.exe
5556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3604	jre-8u411-windows-x64.exe
3604	jre-8u411-windows-x64.exe
3604	jre-8u411-windows-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 5072	2336	msedge.exe	83
PID 2336 wrote to memory of 5072	2336	msedge.exe	83
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 2904	2336	msedge.exe	84
PID 2336 wrote to memory of 4192	2336	msedge.exe	85
PID 2336 wrote to memory of 4192	2336	msedge.exe	85
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86
PID 2336 wrote to memory of 4972	2336	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://java.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6e846f8,0x7ffea6e84708,0x7ffea6e84718
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Users\Admin\Downloads\jre-8u411-windows-x64.exe
  "C:\Users\Admin\Downloads\jre-8u411-windows-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:5788
- - C:\Users\Admin\AppData\Local\Temp\jds240650000.tmp\jre-8u411-windows-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240650000.tmp\jre-8u411-windows-x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11015299901530106317,12673835033527873416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\fa9cfe87a91c4f25b51db3531312e6fd /t 5372 /p 3604
1⤵
PID:5796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
00cb8a925b4c057b30f2bbd05fbf7dbf

SHA1
205a4fde6bb8ff2982d1e53fe56094da2bf16073

SHA256
a51e4146737acaf1d660fbe9432d5db9af9574871713dbe14b139365117d5638

SHA512
58307e7031a96cbda8e5fe18a914e2437c5fceb9c410c97b28bfaffd90924d7425982370faeb1a4f2ffd431185169a7d59336d5ec00a3b2e47260a79cc07d443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
721B

MD5
0bfd59bf121ee06958088ef44f009320

SHA1
ac4b998bfe031a02f5ffae466f978ba3b4baff1f

SHA256
339835f4ca51b4e43600cda77dcc677993d62d949427123495c8662fd75755f7

SHA512
dc445e34605e3aefa70bc347eccdf7ca9e2e3b6641a8f56d267eda569759d03a92879a8d18c18bac24899cef723a52f73233e8aaa7fc9e0ff1bafba761d8a29c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06091313d71f9c3d99113057d60416d2

SHA1
0378157ee9fe0080c31b0c78aad210dd5784e570

SHA256
9f2b3bac35650a6e181ab4d37e3104479413caaf694bcfa316aa0de797fbcb27

SHA512
3dffd11cd09951fbda7700752c0c08e77510fa0ed7c94d18db31f5a6223b58db495a793c21fe121fd612c2b6f41070d6625894d814d216418e81933c786232c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe9bf169f032858fea895d46dd316d35

SHA1
75a4456bbb961dd694bdeb67eecccd324129a8b3

SHA256
92e5e9dd2344c563ad986f37f3ac8994e55725cb505c8c29af4f6f4ae9b55029

SHA512
ad432f995395a3665c97cb39c689b252b3d0f3ce28bfdb97fcb39cff68cd179dfcca9b9ddf6040cc28fc21d8e93348bee051749c6df179f8b51e83addfc8d0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e4fa5f9610d46c52b6bdbd1a834bda3

SHA1
c7515ccd50e73b54f7f88f36b32f63c52c97aecb

SHA256
ce4f820108798cb3feb418dc3a15f6a88e768914a7283e8a7853f73b0eb48b38

SHA512
67e104925d1c08a4d35d6df33ed25918f604b6c0a75df56327a2fd14068987a1ff5ea6557789a2143c2c3aabb0918a5af0d51e6c848de79f3a44831a8b29a48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
4fb591867e67fec542290de833150aea

SHA1
ce58a1ec4b97bb885f185bf002e26abf93a95b3f

SHA256
ee1cc0eb290a9d8745eb54262b2ce61a151d68f870e4dbf4f2d366f0d0e5f637

SHA512
056d397db2d80a981b9b20a5d6455dd12d872158bbf1c2c2ef4e32f7f069959a26dc8a4585c5be62fa2d9c27b6f20de825396dea3c2b73320406aeb726de03d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ac5d.TMP

Filesize
871B

MD5
ef6a9e3209bef59a8dd6550056019969

SHA1
0dafc44321ab3bd8d72dced0d9334ea15099c322

SHA256
42b454a61d5db459adea93d93770ce6e08115f297040d65a3e541a97998c84a4

SHA512
805cd95be4171653383f2c95fdfb6f32d8f891bd1a4289aebd133d216247029a9369378b82428fe7984aa6307639162a695be2790ceb99bfbd6d477789a7b279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d0fdac434353c67ae19ff8990cc2cec

SHA1
313a9fdbe4f64d5bcb7c9c2c2371ac44bc47aefa

SHA256
f1fdd369bde738643fd945e646c6487d41f8adb003b761e2a550283938714881

SHA512
cb95b31568384816ad5020a575966a6167b844a5cd290e308216e654c319d0fede98a9ffa10cec1ac16f886349268c26c776d204aec5a13680149b016059a33d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4b91c815907165ac65f45e9186124cd

SHA1
2d1cde2eefd0c1f32f7687ca425298e200249bd0

SHA256
f30b5e0e70384d2257af35bfeed16b0cb561234d3832e37a815b9ff508cef51e

SHA512
f9bde6f4ee888df626d7bfb4b505d0e8b493ec0fcb3f903c2d6e9357c9e715269fff21c3428e914d1b1690b9945b09c033a9d46f04a6304866a4a08120ec2700

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
296KB

MD5
e1b6666da049bad024bb654d70b105f0

SHA1
c711ee690dbcc4cb7595621d2c4a9b229a45e425

SHA256
3a1eba14d70f50ea13eb78ba31ff35b041b684880c051c3ea49bd60df7bff204

SHA512
55609a183b601b3c44e88e52deee5ea1d00e273ec97f82641f9b5f637e5b9ab6ca060ea887b7dda66fe04f2c773ef58f46a5c10694cd19e6fc09e7129e722422

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
298KB

MD5
a6635ce9e2c020cf99bf4e43a37e54c0

SHA1
0b43ab54c5e95149fbf16f231028c3c100b772bc

SHA256
e539f149e776aae57bd28ec7407681c878048d238e1d10fbf754a9219028978c

SHA512
04da9e5ad9779c01ff5b5f102f63eef541844d7d13a70b5ea9adddad36e8da7a93dd43a35fe6b288d4c137046c0b07ee532eaab6f97919dcb1899f170e9236bd

Download Submit
memory/3604-384-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download
memory/3604-366-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download
memory/3604-399-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download
memory/3604-400-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download
memory/3604-401-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download
memory/3604-402-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download
memory/3604-403-0x000002211A700000-0x000002211BD77000-memory.dmp

Filesize
22.5MB

Download