9f83690b4ba738a40f8993645d5d02d3fda46041bf93a97cbde487fe09e3bb86

Resubmissions

09-08-2024 06:22

240809-g5c3zs1ejc 10

Analysis

max time kernel
1688s
max time network
1696s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09-08-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NucleusCoop.exe
Size

2.9MB
MD5

93ab02f4443af32a0cbf4349cae331d5
SHA1

c02b792d5c03fa5ec1436b62c145a03925d42ddd
SHA256

362a74e9ee98dcf44b26d2af94d14db0234253690e5aff4849735d30534fe73a
SHA512

19fccc2393a3574ea807434a58fda638886aebb1addaaf85e7182871c054fd4767139f8f8444dc2f9e42cf5495f0cef60e57e310883fa90035a43f737931fc8c
SSDEEP

49152:zaLIRnkyRnkyRnkXRnkLRnkERnknAonN:d6y6y6X6L6E6Ao

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

NucleusCoop.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NucleusCoop.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NucleusCoop.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

NucleusCoop.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3984	NucleusCoop.exe
3584	msedge.exe
3584	msedge.exe
4964	msedge.exe
4964	msedge.exe
6036	identity_helper.exe
6036	identity_helper.exe
2924	msedge.exe
2924	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4964 msedge.exe
4964 msedge.exe
4964 msedge.exe
4964 msedge.exe
4964 msedge.exe
4964 msedge.exe
4964 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NucleusCoop.exe

description pid process

Token: SeDebugPrivilege 3984 NucleusCoop.exe

description	pid	process
Token: SeDebugPrivilege	3984	NucleusCoop.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NucleusCoop.exemsedge.exe

description	pid	process	target process
PID 3984 wrote to memory of 4964	3984	NucleusCoop.exe	msedge.exe
PID 3984 wrote to memory of 4964	3984	NucleusCoop.exe	msedge.exe
PID 4964 wrote to memory of 5952	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5952	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5328	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 3584	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 3584	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe
PID 4964 wrote to memory of 5552	4964	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\NucleusCoop.exe
"C:\Users\Admin\AppData\Local\Temp\NucleusCoop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://learn.microsoft.com/fr-fr/cpp/windows/latest-supported-vc-redist?view=msvc-170
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd45b33cb8,0x7ffd45b33cc8,0x7ffd45b33cd8
3⤵
PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
3⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
3⤵
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
3⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
3⤵
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
3⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
3⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
3⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
3⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
3⤵
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,5498365361438427375,3792154290258182188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4604 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
0021bddbe46f59964ba92e82550f8313

SHA1
27f99d81609886f142b98b34d408f62d3001d9b4

SHA256
3e4790da37a874988bf1641e1e149342a480584818a53e970f9c92625f325aa8

SHA512
c69fa5f1a9c546d2dcdc8363602540ea89c896ea4e4e6331499f5e7e8e390a0c74f08c14642d128618035ad79448ca2c1cfc9db9fd132f121896a5096427d81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
0a8ea5dae27f141be6436c1a828dc840

SHA1
d69f06ab302b56ead0af142ad60f5ca8acb4f42b

SHA256
24c8b87b69cc0aeee6ce898bce60dbdca51dfa690e7e0720b58a87b9a16e52e2

SHA512
289759ab1f9636c6147526f3419bff7941f77bdc327ba621c5ddbf334afab9723983ff9ce59fb85c3636d63fa402a50becaa9c232c04afc825509652ce2074e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
aa0b622aaaa3e576ca66cbef9af53927

SHA1
21daf354a8cb68aba0f02e63f29a536d367e5e5e

SHA256
24953b4a48150857074d878d48b0c04cba814b670c8915be2c761b27bd8b8c9f

SHA512
63524360db312f1c97e71f48ff7213b938188a899ae496daa88334929f16b4c338509a259120b42ed8a7d0ae48da91facde7dce83f85496f17f2fb71a5946efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
250741ef425aa96e097f4551b3b0d79e

SHA1
a5297755a9c09d1891ca7622da933dd632c335d3

SHA256
c0a5c46deb9b79e80b4375dd2e91103c2086cf5bf2b6411addef3ffa234a1076

SHA512
6b7b817cf0cbe6ebb4110c7920288f0885a4d73f49b58ecffef123c1c1d393b2e5db2c3039e8e5009037b9559b5a3280dff41b9ceff80af6b7fff8e611fb7f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
25a6ae1a9821bf5941cc61a2d9848bad

SHA1
49d1a3258551669f400081d92123bb66679126b2

SHA256
13e7c6d1009b4083ed4a8b1172ee42a9462bbda5375feabb678d9ec6de71a105

SHA512
e608c960cfd115f58f4a3ef08866439691906db2540505cee7d938c80153903b27c94b28c430a891f728b3472497a57bf5a1256722dd8270be9690d94b9467a9

Download Submit
\??\pipe\LOCAL\crashpad_4964_EZETNMDVTDVLRYHP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3984-0-0x000000007487E000-0x000000007487F000-memory.dmp

Filesize
4KB

Download
memory/3984-4-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/3984-3-0x0000000005E80000-0x0000000006426000-memory.dmp

Filesize
5.6MB

Download
memory/3984-2-0x0000000005410000-0x00000000058CE000-memory.dmp

Filesize
4.7MB

Download
memory/3984-1-0x00000000003B0000-0x0000000000698000-memory.dmp

Filesize
2.9MB

Download