1ba98affea9e32b73e7d31dbdb580928ce63367f253d952508acb255b793ad94

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$COMMONFILES/Angels/go114fa.exe
Size

26KB
MD5

be4cb0b0f6b6b2392e4df25ac7a1ab60
SHA1

445d5b3ad9d14231caa5db1b2d899f37430a63c1
SHA256

5b1a692e365eaa612e11e4f7161b2e2223b3f8171a18516368d646c16bd53e2c
SHA512

fce748853a7f2e524f60c03b6587349c09211648978a9470c9980976b8830d0689a2876f60a6358f5dd8c5d886325b75ace982679ecaf6f9863a96d5d1a00646
SSDEEP

768:JicxqkQ0OJQSf5Q4bDb87SSFAuJJ2m81LLEUbGNl:wcxqkQOYDb87ZFAuJJ2z4QGNl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
3408	msedge.exe
3408	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3408	3576	go114fa.exe	85
PID 3576 wrote to memory of 3408	3576	go114fa.exe	85
PID 3408 wrote to memory of 4076	3408	msedge.exe	86
PID 3408 wrote to memory of 4076	3408	msedge.exe	86
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 2308	3408	msedge.exe	87
PID 3408 wrote to memory of 4132	3408	msedge.exe	88
PID 3408 wrote to memory of 4132	3408	msedge.exe	88
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89
PID 3408 wrote to memory of 2040	3408	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\go114fa.exe
"C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\go114fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.114fa.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc038946f8,0x7ffc03894708,0x7ffc03894718
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:8
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3401731096603786770,10668807428357448396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5164 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a27d8876d0de41d0d8ddfdc4f6fd4b15

SHA1
11f126f8b8bb7b63217f3525c20080f9e969eff3

SHA256
d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe

SHA512
8298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f060e9a30a0dde4f5e3e80ae94cc7e8e

SHA1
3c0cc8c3a62c00d7210bb2c8f3748aec89009d17

SHA256
c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79

SHA512
af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2086386c237428f7dbad7119ccfc71ca

SHA1
b24114daf891a5c1ff7d99717612c9fadfa1b2f0

SHA256
b85a79d8adeaa351ffb7324ea37229f0626c20c5d5cc62004084d5cb4def6265

SHA512
51655b3ed206992247e9446c30dc702b3ed0b8def91c3a0ee545813ee68e2ac41b923b789c6d57e9db5d178333b24c2129ea5bc14ee9f0b838abaec8eb96e7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
334B

MD5
98aa6bc7abd72733e9eb184583dc5412

SHA1
9da048df45c132d125e43d88400c13405b178ce3

SHA256
53357d5e6a1aaa835e827ac5fa91a08a5ce7d2bae3022c9e71087ec836fdb1f9

SHA512
b0b79c6627722fd0dfed90a6ede4910dde1b4191a7c3bc45d2f22a2810ba2551b7a89d4789d144b393b0ac40ab3598becac4d997b2b13b947e622db7dd4ecb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf2741d834922ddaa68a95fd34ab673d

SHA1
abb87adf6ef083759d9b7224da84fd5374c4f656

SHA256
2b74c375ceabfe41e502dd91521ae5a2a78ed91189216a647117bc8d859de7c7

SHA512
55af0bbbcc89207b25f79bc1af44b39c0238ba65c00f9baf5c5e49b86a7067251a0b544a1a43969e3f9f21ee4701c61a0fce2c0365ae7fb9c0cd8312c308caf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc73e6dcc24403aa64ec381ac04d3e1c

SHA1
9953c3d7dc3229f09b8cb43d8201eef506372a58

SHA256
649df3a6f046e0e210e9a916bc64fa60b844eae33a5a1abebac881ec219f9a67

SHA512
afeca41183176be471514f4167caef55440a48038e55bc43ed287df35c96cecb82495988767d2d037449ef118ca449e103f0ccf0685497f96e435a0a25dbe7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64f0a3bd52fab71a4cbe9f82c7f426b9

SHA1
19d715d804b02824810f79ad0100d088966660d1

SHA256
491e9ca46a11405d40f40cf1a4516e8f8d90899d5e70dbd2709444354332f753

SHA512
a0ac15f1a30f7871def7e5ff3556227b3714ab5c607725e3cbfcfd15675bb4c47bd153a6fcc02a5c21e189b2ed00fe00e9996f0aa0f6d0078230d19b96706f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
3bfbd7d46aef325a95925e6a06e4ee6f

SHA1
2a4a8e7a075d7dcb3ec79344595742d83c431bc7

SHA256
3d75702983a4a279eb75b007066a6ae8e91fffa3631a0ddd6093e3bf4d6e5798

SHA512
0277320cdb72314766af1fed1a9fa5b201af6109d0947f28c6706125e916e0c2d64488e9d7288602569bdfea9d948eff43c5be804e2a687e2c312faddc84cb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
8f2f0e6e1af1121640ad5b76670a3154

SHA1
efb93e97f46b1daa3db0cd85b3305e1cd2bd48c6

SHA256
0eb319a9f9d9a1d41fcc6797af6f49a36876964f3464d0a235548dba55631bbe

SHA512
7f61934223a91d8654c0f47f8e51314ab18758fcffe6f9bdb10b653084fffaf421ed02a4f94f463855ad252a76225aea2befa17f621c46d3835d0ce3d6c1bb80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5853d8.TMP

Filesize
372B

MD5
7517c2def252bc6e5f4dedb8cb37517e

SHA1
4573f17132b133e7494f2b6b566971384d43b1e7

SHA256
0ab11c12f253aab1c83116fae006a0e3bbd9a3084bc0a484217f1f9760bd480f

SHA512
8d3779482737e4f7408ae897a939f2b9b8d663ff2c89b19a53939fef3ed6fde8bae134e070939709be87c3c7d8fc1c8b33fc8b5e39d398bb6b21a2076b93dc5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed8b0e04521727a7a8389711df3b0ce8

SHA1
6d055a6fe2792de1642467c9e163011161208ee3

SHA256
44b2b1a54f6583dd818c792871849122bab134b22aa154b6b9d2ec99ad0b95e4

SHA512
050abe8d4fe632e8e55c56e4fe4f4eafc39f0684067afaf2552eafd492dace773001ec89a7b5b981f7f0bbb8e267eaf90ca0dde56501300f6e3abda71a4a12ab

Download Submit
memory/3576-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download