507641e3047216809af93a127af70a266e273cd95c1cfaa06605a753b9166388

Resubmissions

29/05/2024, 23:17

240529-294rqaef25 6

29/05/2024, 23:10

240529-25ypxadd5z 6

Analysis

max time kernel
294s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Delta V3.61/Delta.exe
Size

17.0MB
MD5

774ffee84d8e760761b8819edd2bc252
SHA1

74ff2bcc3baf64790181b97dc09ab951d9440379
SHA256

3c2cbcfb0dc0b92e1a0f15e725a1f8c4756a990e298098d94087cdd3fd491758
SHA512

935624fdaa9ae57d4515a456a9383c20240988848046fcab69948450413e573167c0f17a456f0f5120ec13e3215759ad11c4857873900606116c3e495dd69650
SSDEEP

196608:LOM8QZXcqPrn0guhegnueaIN3l4X+yBXeLUpcgwBj9aR:LOM8EmegnBaS1C+yBaUpcgwBj0

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{1EDD6D70-F7B4-49E8-8729-D074B3762018}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
3264	msedge.exe
3264	msedge.exe
5084	msedge.exe
5084	msedge.exe
748	identity_helper.exe
748	identity_helper.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	Delta.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
880	Delta.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3264	880	Delta.exe	92
PID 880 wrote to memory of 3264	880	Delta.exe	92
PID 3264 wrote to memory of 884	3264	msedge.exe	93
PID 3264 wrote to memory of 884	3264	msedge.exe	93
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 3952	3264	msedge.exe	94
PID 3264 wrote to memory of 2192	3264	msedge.exe	95
PID 3264 wrote to memory of 2192	3264	msedge.exe	95
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96
PID 3264 wrote to memory of 3544	3264	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\Delta V3.61\Delta.exe
"C:\Users\Admin\AppData\Local\Temp\Delta V3.61\Delta.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4TfpR6wUUu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9171446f8,0x7ff917144708,0x7ff917144718
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3556 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3620 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18013703335957357754,6611049504423982317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
4b58765eacbbd9e78352d1d97ed45238

SHA1
fb95115a6d9960c4e7a2712854f2b319171f2797

SHA256
c315bb11c427158b7eec231d29c3e63773e56506d08b012c22047e48c912e88e

SHA512
a6caea8f66cea97eba2843999f5205a0e5277945fdc36cd1d68e43d7af3dee818c66dd1de026e8a8a2c84d42c47b3b6cac6915e8f033f6022aa5f473d7e3b9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
536B

MD5
6fbd5d859311bbbccf41db62ffda5d46

SHA1
03ac403813c943e6a7515803fbfdc034e0fcfcb1

SHA256
381ad706e4e72b3bbbe59e3833fbbc4ff0fe4be0929ba520aae8f061006e323f

SHA512
dad60555fc3695b0da245c52bd1c61ef3ec372e792207fa8e1d84a39ee0dbcf84c80f7719e909e0e82ef7d72544a735269759e3c7b014f05d41602177d1bd24d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f503b1bb27452e2f5b28678875cbaa98

SHA1
0c4f9c1cc28c3e711da11b2c7c5e1697c5804361

SHA256
73b1afe28a88d9c355c29cb732e18bf423fea55a1e758cd2000b2eb1c29a19f8

SHA512
23a5f64eff6c84249a239dcdc1057e4b5da59ab29dd9aa71a56524c5379076973e511b77da45b250a03e8bc869a4d21420c3a5d05e16071a2398e238b4481b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70606c7da2702b5c0e688d715b95c752

SHA1
80cff88ad07f91e101e446c40680d1a84208b141

SHA256
84e92a70dcc0d69c8e7cd6d06838211e703e09f5232cd4a93d5dd9ca4cd260ea

SHA512
1e30358f57559fdfb7eb09b8056d7afd2d6af65a77ae00b6d4f70d041eef9e7061d083108624b36102fa4f794aebddf742d718f12ddba1e5a9dc51fd3fb3aead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6144653926207bbe7966125a7702fdf

SHA1
a2db623a4c24cb7582e7864f00d0eb68c559102a

SHA256
a26af4106facd369c998bcfec2defe003012fbbdd18c9d3eaab490247b870e39

SHA512
d2f0c4dece769231399533ccde31c8e0fdd744751cb8b7d360b8d48417317936929bc914391c2801e0cfd2ca9452efc8d75201426dbd279a20d9d450e9381923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9c6b9e244c4eaf0a3155d3c36a47e136

SHA1
8d5fd74565b388fb3a8b7c638e33f28635befd03

SHA256
785a418460149540977c3c3c38a620a8c7fef79a9906553056664ecdca979ef2

SHA512
11f4a524b09d5feadf93d4ea39aa5f36ba7b53041ab9f058cd0d5e646cae7fb12e48af77b94882164e622193b76630950c2cdb17d3c9f94be79c2103c253b541

Download Submit
memory/880-7-0x0000000006950000-0x00000000069C6000-memory.dmp

Filesize
472KB

Download
memory/880-6-0x0000000006520000-0x00000000065D0000-memory.dmp

Filesize
704KB

Download
memory/880-15-0x00000000751E0000-0x0000000075990000-memory.dmp

Filesize
7.7MB

Download
memory/880-16-0x000000000BFE0000-0x000000000BFE8000-memory.dmp

Filesize
32KB

Download
memory/880-13-0x0000000007300000-0x000000000739C000-memory.dmp

Filesize
624KB

Download
memory/880-12-0x0000000006E90000-0x00000000071E4000-memory.dmp

Filesize
3.3MB

Download
memory/880-11-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Filesize
120KB

Download
memory/880-10-0x0000000006910000-0x0000000006932000-memory.dmp

Filesize
136KB

Download
memory/880-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

Filesize
4KB

Download
memory/880-14-0x00000000751E0000-0x0000000075990000-memory.dmp

Filesize
7.7MB

Download
memory/880-4-0x0000000006330000-0x0000000006368000-memory.dmp

Filesize
224KB

Download
memory/880-5-0x0000000005F80000-0x0000000005F8E000-memory.dmp

Filesize
56KB

Download
memory/880-257-0x00000000751EE000-0x00000000751EF000-memory.dmp

Filesize
4KB

Download
memory/880-258-0x00000000751E0000-0x0000000075990000-memory.dmp

Filesize
7.7MB

Download
memory/880-3-0x0000000005EF0000-0x0000000005EF8000-memory.dmp

Filesize
32KB

Download
memory/880-2-0x00000000751E0000-0x0000000075990000-memory.dmp

Filesize
7.7MB

Download
memory/880-317-0x0000000010D20000-0x00000000112C4000-memory.dmp

Filesize
5.6MB

Download
memory/880-318-0x0000000006A60000-0x0000000006AF2000-memory.dmp

Filesize
584KB

Download
memory/880-1-0x0000000000490000-0x0000000001596000-memory.dmp

Filesize
17.0MB

Download