89e19955aad370a9954e66ed1f3b42ed2fc99fe69af7e7851e420bb6e2b57ae0

Analysis

max time kernel
35s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/08/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

netbeans64.exe
Size

287KB
MD5

3ae136d35edcbe8d49b1d52e538bc057
SHA1

2474dc766f4249a42074da3e7443e87b39521a75
SHA256

89e19955aad370a9954e66ed1f3b42ed2fc99fe69af7e7851e420bb6e2b57ae0
SHA512

3bb440a9174f8bdb8255b9ecab7353d9602d233618cd38adb7290aee56883f4280c4eaaabcb54b6176e303b889c48a3133e6401d4da0786b21006cf4c14a1399
SSDEEP

3072:QI2cH/tkk8gdv730s4sT1NvO2Bw7Fw/MqisBI5+S9YU0d71ZnQvSl2Rz6:QI5ND0ykFw/Mq4RYU0d7S8I6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5028	WINWORD.EXE
5028	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
3012	msedge.exe
3012	msedge.exe
1536	msedge.exe
1536	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2332	3012	msedge.exe	93
PID 3012 wrote to memory of 2332	3012	msedge.exe	93
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 1432	3012	msedge.exe	94
PID 3012 wrote to memory of 4868	3012	msedge.exe	95
PID 3012 wrote to memory of 4868	3012	msedge.exe	95
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96
PID 3012 wrote to memory of 2476	3012	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\netbeans64.exe
"C:\Users\Admin\AppData\Local\Temp\netbeans64.exe"
1⤵
PID:3304

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ExitStop.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ExitStop.docx" /o ""
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e1423cb8,0x7ff9e1423cc8,0x7ff9e1423cd8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12483821105077517634,12578769962451851180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
987062cde70b977ff2fbd68b09bbed4c

SHA1
7d3576d4d45ebeb473b8b2a30ad9a3f2bf3d2ca8

SHA256
be83bb39902f0ae268a1cba08c80d573bb23b7c0be0178a023c94e7a7bc57f99

SHA512
6c3bee9144b14e46c82a55060bdef59666cdcf412ab310edcd55363cdd5d3640968727dd13dab0ac27cd45cbc8f6760e0f25f9aa9a422c4b71fe2b915717c901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0a5af2d24331d98c8ea9453c8c4506d4

SHA1
f4ee19a857745994d2ba798931e26a130d8f6b95

SHA256
d90e289a900ebbd7b5b279c21d3af24d855a78589275dd4454e393df5d1d901d

SHA512
d5cb47f06f4245146e2cbca3d1c5dccbef7723a27e3e57292bf117855b4c4dd12be9e4adf5dda4aa76fd819f1c21a9f75074dbc71b056a65af2416d81a839990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85c9c2fc8a46efa0dc2d4ba8e3f7155a

SHA1
0168a93f90613b97236536418753d8f37781f78d

SHA256
9b7d1d048d20b7a63136cc3982fb72ce1d0a276a23e23cddd2afde6a30f3d13c

SHA512
73e302a3d5b04859310b9cf8834a7dbf3f285712af417a2bbe50a0cb43efb77a52bf3f83bc7fce2b724172a75bd786eb8e3d0d6a33c97fe9eb154ea62b0b705b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee972fec92e27b00b045aad7bc025623

SHA1
8fa006f36a6634ef9cfb8ba2ed2c33b6a589c5f7

SHA256
31c5f51b1d441c6d3e3ae5c3ad3550fca26ba79d52c4f9c4176d0a1b03fb01e2

SHA512
b19ad233a63a60c4430f5a067db5492255b0d671853c606f549e7fb0c8ad3b0f11942c33c11c90217aba52682f35f5595275c3b358c16e5924ee612c47afc518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7011d3e71da73956636da5c61f1c2b0f

SHA1
66d9d9d83dabad51a56b6007d43243c8aaf6458f

SHA256
b9ddb26825d0643d69f61172ed8bacad7ef5395e306506bd55be992d20f76c53

SHA512
d732e92bc2ad0595ad709fd98a0f15c9cec09477c60565324c8cd3e9dda63d589824a13c39b4c7fba6bf282f777df6bc844f69b14451bc3c2436763ab9189ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97e0e2f6ef0777017c510c6be9c8fcb8

SHA1
36efe742626a2a16812baa7138812d255d0be6fd

SHA256
5a66bc12ec8df483f947873d747b1fd93ecfaee2a462508ca103f0e81103a29a

SHA512
781b29ed1d03f07e600d972ec49b30e72c54aa4ffd814e2c88974c65242e1e62a1f0e6fb7202ceaee47a486d5ed296c73ac5139cc9331d25eb7db00209eacccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6e36c719668a2ead31a030812c807a8

SHA1
9febf8a70aa2a23e6130cac48ec71d8ceb9efcc8

SHA256
bf72bd0d073ac0e06eafbae1adf30da032fd5e08e002e0c175166f68e890a4bd

SHA512
6c42d7029ac889acb06dc1612397ae144029aa124b286191fd130ff55951c9b4910c7068f613fdc2c954e70de6192189cbab287f98a51330a8b2ff1a903959d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
337B

MD5
2ef83ae6959cf3fb5f239167d675b32b

SHA1
7f822f31477a5c0b27095ba121a2579cc297eb55

SHA256
4118f3d06007344925140417f7d9d287aa9ed17e9ce59897c09c938d7f3f3403

SHA512
20bc4ab429ba9eaeb2f776b0af4e5603e1b1fa874c23bd621bbfa6f43033ba20be33692032f0884f2b648461bea3e669d8e583e7985b8e62373327fdd957e789

Download Submit
memory/1276-27-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/1276-23-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/1276-21-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/1276-22-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/1276-26-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/1276-30-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/1276-29-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/1276-28-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/3304-0-0x00007FF669000000-0x00007FF669050000-memory.dmp

Filesize
320KB

Download
memory/5028-14-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-24-0x00007FF9AE580000-0x00007FF9AE590000-memory.dmp

Filesize
64KB

Download
memory/5028-15-0x00007FF9AE580000-0x00007FF9AE590000-memory.dmp

Filesize
64KB

Download
memory/5028-6-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/5028-65-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-7-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-8-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-9-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-10-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-12-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-13-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-11-0x00007FF9F0A60000-0x00007FF9F0C69000-memory.dmp

Filesize
2.0MB

Download
memory/5028-1-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/5028-2-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/5028-4-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/5028-3-0x00007FF9B0AF0000-0x00007FF9B0B00000-memory.dmp

Filesize
64KB

Download
memory/5028-5-0x00007FF9F0B03000-0x00007FF9F0B04000-memory.dmp

Filesize
4KB

Download