902c4af63b5c77e23636001eb59eabce31380d2e310e483f03b5f2d40f1bc5b5

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usermode.exe
Size

841KB
MD5

f8b0de77396a65e55a6e3a3068d81ef7
SHA1

20e3d74dabc53283682362f5caa66427841c009d
SHA256

902c4af63b5c77e23636001eb59eabce31380d2e310e483f03b5f2d40f1bc5b5
SHA512

db8789a2f8702a722f2ffc91618960ef2783c6e18cfe779ddadbdeec77d30d40af1e82ded426414dc19fc63d652c1f98a7de51744e2a11ea845105a736dedff1
SSDEEP

6144:Xt4+19w1q16E2LHDpTP/20QhFOeuGfniPCUnyLc4MpHwKV+yjSbw/Wlk25WBqQU/:Xt4+8zz1z/QhFZfniPTMDOyfu2K

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5532	mp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	discord.com
18	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\dr.sys	usermode.exe
File created	C:\Windows\System32\mp.exe	usermode.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{A2E8B0D8-C03D-4326-9AEE-092A83D822C8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
1936	msedge.exe
1936	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
4740	usermode.exe
4740	usermode.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6044	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6044	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 748	4740	usermode.exe	87
PID 4740 wrote to memory of 748	4740	usermode.exe	87
PID 4740 wrote to memory of 2132	4740	usermode.exe	88
PID 4740 wrote to memory of 2132	4740	usermode.exe	88
PID 748 wrote to memory of 4472	748	msedge.exe	89
PID 748 wrote to memory of 4472	748	msedge.exe	89
PID 4740 wrote to memory of 3332	4740	usermode.exe	90
PID 4740 wrote to memory of 3332	4740	usermode.exe	90
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 1432	748	msedge.exe	92
PID 748 wrote to memory of 4812	748	msedge.exe	93
PID 748 wrote to memory of 4812	748	msedge.exe	93
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94
PID 748 wrote to memory of 3848	748	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\usermode.exe
"C:\Users\Admin\AppData\Local\Temp\usermode.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/saturniv
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb974a46f8,0x7ffb974a4708,0x7ffb974a4718
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14172473197424439175,16037539225493691983,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 5
  2⤵
  PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 6
  2⤵
  PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\mp.exe C:\Windows\System32\dr.sys
  2⤵
  PID:3148
- - C:\Windows\System32\mp.exe
    C:\Windows\System32\mp.exe C:\Windows\System32\dr.sys
    3⤵
    - Executes dropped EXE
    PID:5532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
376e3d142ce7a56feeb28ab244df050e

SHA1
02a1829b1ad983493371350c2177dfc8540c3ed0

SHA256
23a5aa4023a90138aa864b8a3e10c15440f082135477523471aa7462004eed32

SHA512
37c08aed1232c189166a96e8a96776feedb67f04c40d6797af2504b7f206ab21a0a12b6852449c927f04c1ec150aaa8f462a68f1db8d9f16c73908ce6f1b1e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
835B

MD5
e4f3f95da4c01a3607e41fdba2835498

SHA1
954f433f2778acc05d0bb08ccf801c784959579e

SHA256
33fb9458b9c4507e5c0ffb14a95e7220adb83a5ae3b057f900a29a59b75982a3

SHA512
ee4676d3a830c898814217b72725064f97a472b88c1cf69b18de77b529c5596db7306f02585fa98ebc6866901a04626709b504ee8dfef7f2e0d83d5d4d3306e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f897c21dbae88e29ebaa73586c3ffcde

SHA1
7563a06173f3c04c9a492e44a303251a9e694b3f

SHA256
fcf3cbf574d525dfbdf621f1d64da34cc65c5de97c8fd46386f1c06b62ab74ec

SHA512
9220c02635c22bf35c79d1fbcdacfa47b23c28e905fcb9b8ae71f41ddf1a00b1767f67d6ffa935d0ace92f57771ce799a280d6dc2209db118c291af995c10dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12a5a918a36bf679b9c6d1c5f0c64078

SHA1
9726ff943a1397b9f709d3012dcac3810f5372ed

SHA256
bc6f60934ed14c3b1345249372ab222797050ceb441d2773c3a3c7eeaf0c3cba

SHA512
041f02239a2ec3946db5a35d9a2a25d6449604d9fecee6012a95a91fecde4739e847144f18d8e2f7f2dd62090e6d86fd4158d54c67d18455a493aae3a287f94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8ed86fa49315527a7eeb8d7abf98998

SHA1
ad27702749d93887602043448a585ab705c6fa16

SHA256
edb3792488f7d0e3abb9dc2c51192a6088189c6739e3c14df44ac7466edb4bba

SHA512
a01921e629e0191c5f6db55ae9b810fbf995f75b888dca9c20f4d07018c9d5a7d868b9399d94fb6e107ae18b7920ef3577dfc23750c3c8b912211516ba11e7b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e7740c7795ee632b3e33233d5e97ead

SHA1
43b63d9a4b0f965c0e678a2d3b26eb6a4780281a

SHA256
26b3cfe930a8afde0412bcc1d9c27b9655773491550e17e10e8b8ad7c78df2a0

SHA512
ea25c8642926546fcbbc584616c06a077161be221bd45d981e48a2380ea582fdeca82030c2140c8c1661c6ff267e21222853238ddf3b97f2d13cf8d8f075d35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8819e99e4bf84155664a95444e2cddfc

SHA1
d2bb75f2299e346e7e63750735a87513385329a8

SHA256
ec467a63abac621260b29b95a843d2deb69c4b2ef88236f7a3d92054fd9f2584

SHA512
b7fb56637031db86286db0807320d29c453a04cb63aa8a8c318e543b2ff7664f7e0cb86f749a1cdc41cb4a683089d773dfd116877b36b6e02b6ea95cf36aafc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2b5d6e2e810b9181d64d7e3964a88e8c

SHA1
f895f052d9139d9c42dcc14e3145985c0a68d79c

SHA256
02ea69e76172bdd4a910e05e0a691e573c3d990553606fe48a43471286785254

SHA512
9c7cf8298aa20b28f5d2bb86e821626b3fc6eed87fab976aac2567ff81c28b4bc06719deab761f040d37bb7c340979be5ab5752d857e6a87ac86615f3cc7c566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac0a568b8d6a24df070dd809ef57d205

SHA1
3bdfe4948ab6f5823c8b316a070957a2126a102e

SHA256
8a03f996b3b4c3aaba10d9330d307455c17ce354d75c74ceab6ad3ccb864cf6d

SHA512
aa14cb59c18e8f02e8fbd585e3e3c61f19f9129b9a0ff273efe94a40618538a4a1284becd3929b4377dc230e9caf8a0e8f4c73cd1952d7af4a36220531e27777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6463ba446a89df0f754cc2c2510f301b

SHA1
9720e2314d5a04d10271da50e62c500a99d522fc

SHA256
7b4e638c65b2acae436b7af843e46c07f92559c831d6489677113bcaca2469a0

SHA512
a46b5389e914b75d0df4f8932272245488c5413494f0517fd3e95ce2b05dc42d22ab9bfda18a4b4895451bda72593f3bedd17ba64f7d16f766686eaa1042bc50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e29a9856442fd00e0eec2ac42f64791

SHA1
050f3510ef5293dc351f362d26bf56613e391bd5

SHA256
e60b88aad68c0c285db213d0b056acadd8b6691ae01be4d084fc737ecf7e701a

SHA512
10ce3762d5358857f7650764ab24071227595370484225ba8fb3f9b46679637c992c4c782626707a147346553682e79074b47db54143b3f6620d5636cce7849b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58702a.TMP

Filesize
370B

MD5
115a06b398f81da1e4a2e551e58c8180

SHA1
3a9a98834e534690ae8e0cdefadf7b639e7dc03d

SHA256
13c21a82f9f7c13ca8703d78e4b47d36e4554c307387975316745c35560a4c2d

SHA512
33d2bd7df28981f751f5b0b83f5ef14c91f812e3ee805b899d3d08beeb1b8ca5d449de315b1b0b9f23b38c02e9bfbb356b5ee4a245141f672bee7391e676c3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3803f0eb6b829aa71458fa0fa1665c12

SHA1
477594bb9b7c4c941b69f9d2d213bd2ba4e4402b

SHA256
b9fed01f56ade48709e9a8148dcfa9c7096a8d4ab6842f3dab9fcc14f5dbc5f0

SHA512
ea45b22b87bf75c7a46fd7428474761c4ec0d4f1a3255b110d98725ea3a70b7bd1be93156f52097dce1afe631e0c1c47609dbca9c032131dfce90e9073e87dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df72917c30861beaed42257a856b5815

SHA1
0d6920e87c1f11af24a92b5f067d15e2db8c7868

SHA256
f7f6c77fe966c04ee06fd7d38179812afd9fe7f84ca2ea7f4dc79bb3e7ec64bc

SHA512
4009726eb22d659287e944a382b56c07497c6f7eb2143fa1862b4a2ac31585f99ee71e6d3ff68f9dbce6807749117b488cec64bc897148b76ef476bda11dc880

Download Submit
C:\Windows\System32\mp.exe

Filesize
530KB

MD5
54ed683eba9340abf6783bd8d7b39445

SHA1
950e3c11c71354097c8440529b31f8ac2b3c32a8

SHA256
2d0a9d5ca563ffa82a974903bb43411b22c863311ec926449f08d16f483e4e70

SHA512
9ff8c110823bad1e0a79a810b151e1d5557022080af0c8aaa9ff76996bd040747346f62459c50468cf86f49389c0e5fb7f057e9bd30fa31fed49ae5692d50ae2

Download Submit
memory/5532-426-0x00007FF6ADCE0000-0x00007FF6ADD91000-memory.dmp

Filesize
708KB

Download