agenttesla | hxxps://drive[.]google[.]com/file/d/1Wj07ngMff9_V0N6-76x4czf7APGZn0Bw/view?usp=sharing

Resubmissions

13-08-2024 00:24

240813-aqgpaszajk 6

08-08-2024 21:05

08-08-2024 21:04

08-08-2024 21:04

08-08-2024 21:00

08-08-2024 20:42

Analysis

max time kernel
55s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Wj07ngMff9_V0N6-76x4czf7APGZn0Bw/view?usp=sharing

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/4724-118-0x0000000005750000-0x0000000005964000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

pid	Process
4724	7zCon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zCon.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	7zCon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	7zCon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	7zCon.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 572812.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3564	msedge.exe
3564	msedge.exe
4068	identity_helper.exe
4068	identity_helper.exe
1152	msedge.exe
1152	msedge.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe
4724	7zCon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	7zCon.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3416	3564	msedge.exe	84
PID 3564 wrote to memory of 3416	3564	msedge.exe	84
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3016	3564	msedge.exe	85
PID 3564 wrote to memory of 3188	3564	msedge.exe	86
PID 3564 wrote to memory of 3188	3564	msedge.exe	86
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87
PID 3564 wrote to memory of 752	3564	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Wj07ngMff9_V0N6-76x4czf7APGZn0Bw/view?usp=sharing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd83a46f8,0x7ffcd83a4708,0x7ffcd83a4718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Users\Admin\Downloads\7zCon.exe
  "C:\Users\Admin\Downloads\7zCon.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3829518241400769721,13704955273781817408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6148 /prefetch:2
  2⤵
  PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
46c5804246e335bbf1f5ea1793b8c66d

SHA1
0d9a910ffaad74929c04c54a319181d728ad1f34

SHA256
8bffd14a391e8beb2f419461b6a7140b77e37e5fa3c499ff76732be9d8e68153

SHA512
20b9c470ef96ce706784e4f4a6b82cd7616d37c9ca801bcddc2242477c17271a86b4901c5b1616659b61e33e756201b3f26571417141a8b055179d4ba1015d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
67fbcd6f937ba9a907978bfee2605239

SHA1
17e6fe3e6053705d4e829cdc97d182622a5b17fc

SHA256
d96381e2e39b11f79d6b954ccc727e0b49fe718febc6bdeab9e31259fb0bc230

SHA512
49594c5ecd04baece6493ec35469fde6240877acebdd9afa011b9f1138cb24e273ce6a1e878bdc70efe69735e5bcd2724c64b910452ae87c7d6268c08b841f19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9973074775ee92761e3922c1a6de5d30

SHA1
e36ea9a5294f6d136f3ccf8b9ccc5055a728513f

SHA256
4e922adadcf138bcf8fa56421c12dc583069eafee714e5b9c6e7a6f03a8177b9

SHA512
e40197067c2d251814c80d61b0b4087bee06a2d46bdeb14517cb2d7a9559d9e4426a780912ebbe3ec508e4370aa95e379fa24a5e9b9087ce2935526cfb5e8ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b07ae0ccf459708cca9b2c0d0dcd591

SHA1
86192e48a9b4eaa3ffcfac8ebbaea2e13256edb3

SHA256
e168048b6e8e401979b0fe71a6f67c4c87b12dfa38aa09c785317515c0a7f1b9

SHA512
33de02c8b3ebc791dc327bda0d051abd16f10b11bd67a77b90237522a500aaf7a123bfa0d0a9f3860d7e6ed3ff81b8ee61c8d9bd0de8cb1692240891754c847f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b92e4e8b927bf09487dd34cc61efbd3

SHA1
2f63af7f6ea90897a9748bfc186a2bf8266c489c

SHA256
0b8d1eabf821edb3584b8419952f2873cded594e09d37e7ae4b4586b6296eade

SHA512
3c2f138ad6d838ae892ca821fbbd590a244f8a54a8a024ac0b969d29be152f140cfafaf46387f150aa700d836d4209290f92094d6cb09f3a3d86eca6bd1afe1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
33673a991f9b1aca02a66adc368d2fc1

SHA1
1b761ab755a9681b0f86af554c84f1232e85adf8

SHA256
9012e524e0a269bbd04dd97126c4e4b9ffbdbe68cbd062e563c31328c0c3d77d

SHA512
9f7cb0b6c0efd163b24bb5bae8748357571d6e5df78dd8decf2d7dc7bbf6ce3c340bbb4fdb213cf6ce09184f262d0091d2334779a5cbc2d16d0d5fe4e0706f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77b79a40c5c0249e267275672f42ef86

SHA1
d1664292d6a3c02210439eb1c66b91eac5ad6ea5

SHA256
b306102c2d54d28dfba5359324847aff6e41e9d8c52de87b749a1472d283eb67

SHA512
c731a0b3ff349013750bfdb37d7d7fcc17b605976f575f3b132b4bc34127ea8b62a6a8a121fa825f12d8a0568a235f8977e7fa017dc3a88e6d0d15169f7e5e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
913187bb1f2ac764a228669b451de071

SHA1
74c5056578d2b7e183a8da06ef20533c1274b5fa

SHA256
d88e1d06185e626338fd6bcd0f43c82827c946f618b7037c98f1261a31a61993

SHA512
ef729f4e172d0d534e1175c09f3d4cec11eed56f74d64f5824a6bb338128ab7c14d4a17dfdac2bfdf2009db0020a80ea3abc1489f84ec63fd665a48d7e38abad

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 572812.crdownload

Filesize
1.6MB

MD5
231aa8bca139b5221179350c75014b8c

SHA1
f3c3456257ebd16c548861c248dba385f4fb5120

SHA256
f36e764587ea0d9e11364210d1ab41911d93bdb1c14a9d9146b677a56e626c50

SHA512
01562410cb8bd4feacf8e38413b57161778689cbc9b20f6017700f3737de925d3fd21e95451701a135ad120606004a452bf9c0f59742437bea8b9ce94e3ede25

Download Submit
memory/4724-116-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/4724-123-0x0000000008220000-0x0000000008286000-memory.dmp

Filesize
408KB

Download
memory/4724-125-0x0000000008530000-0x000000000856C000-memory.dmp

Filesize
240KB

Download
memory/4724-122-0x0000000007AE0000-0x0000000007AF2000-memory.dmp

Filesize
72KB

Download
memory/4724-118-0x0000000005750000-0x0000000005964000-memory.dmp

Filesize
2.1MB

Download
memory/4724-117-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/4724-115-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/4724-114-0x00000000007F0000-0x0000000000986000-memory.dmp

Filesize
1.6MB

Download