hxxps://github-scanner[.]com/l6E[.]exe

Analysis

max time kernel
42s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github-scanner.com/l6E.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

l6E.exel6E.exe

pid process

3748 l6E.exe
2344 l6E.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

l6E.exel6E.exe

description pid process target process

PID 3748 set thread context of 5036 3748 l6E.exe RegAsm.exe
PID 2344 set thread context of 3748 2344 l6E.exe RegAsm.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

pid	process
3748	l6E.exe
2344	l6E.exe

description	pid	process	target process
PID 3748 set thread context of 5036	3748	l6E.exe	RegAsm.exe
PID 2344 set thread context of 3748	2344	l6E.exe	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RegAsm.exel6E.exeRegAsm.exel6E.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l6E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l6E.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 520570.crdownload:SmartScreen msedge.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

3132 msedge.exe
3132 msedge.exe
4112 msedge.exe
4112 msedge.exe
5024 identity_helper.exe
5024 identity_helper.exe
4472 msedge.exe
4472 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4112 msedge.exe
4112 msedge.exe
4112 msedge.exe
4112 msedge.exe
4112 msedge.exe
4112 msedge.exe
4112 msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 520570.crdownload:SmartScreen	msedge.exe

pid	process
3132	msedge.exe
3132	msedge.exe
4112	msedge.exe
4112	msedge.exe
5024	identity_helper.exe
5024	identity_helper.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4112 wrote to memory of 3964	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3964	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 1792	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3132	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3132	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe
PID 4112 wrote to memory of 3116	4112	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github-scanner.com/l6E.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
2⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
2⤵
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
2⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
2⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
2⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5376 /prefetch:8
2⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
2⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
2⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6584 /prefetch:8
2⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,9376322447089192471,13459160825326893087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4472

C:\Users\Admin\Downloads\l6E.exe
"C:\Users\Admin\Downloads\l6E.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- System Location Discovery: System Language Discovery
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4636

C:\Users\Admin\Downloads\l6E.exe
"C:\Users\Admin\Downloads\l6E.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\l6E.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1f26eea2d9f985349c7000d24c11494

SHA1
2f8f4448fe1711b5060824784191c1671741a222

SHA256
4e8aea88d99acb1c4109b43322795d39bb9438b746a815dc076d03a1e751a516

SHA512
cd24c71e0031553a4b445b5f7b219e180567b8f58a2657afe0697a21ba9a07e65bf1f3ede5e43bf75780f6c81387c48f6ad9cea694bb9da894a20763f8de75f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd0a39cd72632ffd2e57e18b388deaa9

SHA1
c7502340df8db358ce2f1f39e96cf756620d04ea

SHA256
af28722699087fd227d0c4a9231cd4407fd0ffd9f9839069dad8a485bcaa20d1

SHA512
54abf6fb94a2f1b9ca3b84c2aafa80b1039a3d2441d1f7feb851c2bd75507df6c8c54e8b806913e27d10253957396152a494586727ee38ec46ddee894d65bdb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b42c27958e5c8b9628408400fbebda45

SHA1
cc11daa3e97161e355229596d246d3a5542b7324

SHA256
16e0edf7a9c5d8f5112c5e33539a50a73790928297938c1a907342bee6bc497b

SHA512
ef36fea627f7432ea69475b580757eef32583c760f904f4e291fce15d860f1857b863a059cc4872cefb7c08f9eee236b914d4c7e616dc78e78d130e1e454fc6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
719ca96d116db059740dd000ee340c43

SHA1
a1bd18f309392838ca4c98f9366733eb8a234154

SHA256
23410b02ca48819d5c7780f8c6fc499f51f0127de1fd33dec91511315051b3a9

SHA512
9ff5578e1725e0377c35b14ecbda004727789b74fe4502aaf162119094109a08f736ced26ba61db715706053e411d9a8044a8193b4a7221238fb92eb4e1eef87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 520570.crdownload

Filesize
345KB

MD5
fac2188e4a28a0cf32bf4417d797b0f8

SHA1
1970de8788c07b548bf04d0062a1d4008196a709

SHA256
d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207

SHA512
58086100d653ceeae44e0c99ec8348dd2beaf198240f37691766bee813953f8514c485e39f5552ee0d18c61f02bff10c0c427f3fec931bc891807be188164b2b

Download Submit
\??\pipe\LOCAL\crashpad_4112_CUFVHQDNYIFTAKBV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3748-83-0x0000000000590000-0x00000000005EA000-memory.dmp

Filesize
360KB

Download
memory/5036-85-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/5036-87-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/5036-89-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download