06812518a722af6f98fbd8c3a5ace0cad1c6d53477972618728e64bafcbc948c

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fiddler.exe
Size

3.5MB
MD5

32cf2e7c6ae825d5f7cb2a7d39c2ee24
SHA1

262176d879e7727375025cae4aafc90698adad26
SHA256

d7ea71114bfe70383c1ac2be6dd19676805a0afb6e20c0ad3000018afad093e5
SHA512

a72e70f1a11d4443aedc56a2453cb3ed05bd8106b0e906364f23f01098a378440d2d86ac15f6d98ceedfe18b0a60d80f6806300b390c2969c3de97cb380b82c2
SSDEEP

49152:0Ms91NvXsJm+5Tti9og1fcaufet3YG5kCTnEsRH0jgB3:RsfNvXsJm+5TtiTMfeJnEsRHAgt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
844	msedge.exe
844	msedge.exe
4036	msedge.exe
4036	msedge.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
624	identity_helper.exe
624	identity_helper.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe
2036	Fiddler.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	Fiddler.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	Fiddler.exe
2036	Fiddler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4036	2036	Fiddler.exe	91
PID 2036 wrote to memory of 4036	2036	Fiddler.exe	91
PID 4036 wrote to memory of 4736	4036	msedge.exe	92
PID 4036 wrote to memory of 4736	4036	msedge.exe	92
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 3668	4036	msedge.exe	95
PID 4036 wrote to memory of 844	4036	msedge.exe	96
PID 4036 wrote to memory of 844	4036	msedge.exe	96
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97
PID 4036 wrote to memory of 4940	4036	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\Fiddler.exe
"C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Win8EL
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa38fb46f8,0x7ffa38fb4708,0x7ffa38fb4718
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4336641039283837646,12449407767962477277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:3196

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
38bc7423348a8096d550bdf314f78b55

SHA1
9895260ecabde3d3e75d68cc8d41de1532cfef1a

SHA256
470aa5f5121051009687a5f92e21c4a5638488d5f861a4b22ae9d24751cb805f

SHA512
3c8c53794da9146785e6b49e4f509f60c02de35da3818d74a35e10e09ea4df0ff9e08ca863ee9278f65c2cf35010df93896be80cb88fab1413ce67c5dd2a02cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
519B

MD5
6bdbd35c61e59f6fe16d9977874ea303

SHA1
9e344ba21519d3dcb8e870db620fbdf77c32ade4

SHA256
51e9c77fca6576d6aa31f528b62f7cbf2d8ac7d0c7f1b74d57e9ef6170c82c19

SHA512
62f8685a0df46814662060014462972847d598a5628f32ea1343b5f510aa5e468b9c32277cd7435e02f6d3c4f3555b32f9e542a90533216097116142c700bd71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3efac124674867588c9fa79d21f98948

SHA1
f8c82005dd34ef9f62b1417c1409d432bc3f5df3

SHA256
d6fd4b04858b311a37cf78868a532ba2915cda96b82bc90f509da5c0a54640ff

SHA512
80b1347ba2c400bac84b8938d02ffa056b2831ac0ea887d7c9b7483e9597fe754e2e6e832d71969d75d22368926aa7c76e8e7ad723a282cd8ee3517335625f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b09850c76733cf0565d8e22dad5e3043

SHA1
549dbda84a95336264031ee7079f5819dcca4658

SHA256
dd81c6b2672870ae9e9a8bc197bd3f868af7fd5a57cfe2c906d6ce7bea6f139c

SHA512
9d0bc9fe248af129b37df5c6c9e134c23c300814219e115edbdf69a2e24f9bce8174bc23573dc9cd7693af015a0ac6839edcc6204cae954783a844cbb9466310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7e13bb0115c1abe1a5aa094fec55e19f

SHA1
93f4bac9568e5a0fce64c800a88d14369d3d0ed9

SHA256
4532cb01d46db96b065b2a88d67013e67d26ef287ee8b732b77ef92e831513d2

SHA512
9e5576e1483874ac5848c3fd90c2bbd4b88ce794d400a7cbb76b11d1320fba9285ef71e23295e091b3ec74a5b5b76dc465d75c426d9962811d705db5d09dbbd9

Download Submit
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20242.10753\user.config

Filesize
966B

MD5
e54abd540315d0e99bae79b60e0bdce8

SHA1
802963338989c859727e82a4c2bfa5efd63bcd8c

SHA256
e11f901e1a9fe1da51a3430a6766c4b140eae40e826f9d5a81166ea84927a0ad

SHA512
b1bea7dcbf0438791a47c75369181dbb23d651d9d0cb5adf39ffca7a7b287e2c09bd0f20c82fe96400db8bc37055f59f45e1586af60f3aa9ebf1ffbad6a0adbd

Download Submit
memory/2036-11-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-30-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-12-0x00000243FF470000-0x00000243FF4B2000-memory.dmp

Filesize
264KB

Download
memory/2036-13-0x00000243FE1F0000-0x00000243FE202000-memory.dmp

Filesize
72KB

Download
memory/2036-14-0x00000243FE1D0000-0x00000243FE1E0000-memory.dmp

Filesize
64KB

Download
memory/2036-20-0x00000243FF4C0000-0x00000243FF4E6000-memory.dmp

Filesize
152KB

Download
memory/2036-19-0x00000243FEA30000-0x00000243FEA3C000-memory.dmp

Filesize
48KB

Download
memory/2036-18-0x00000243FE210000-0x00000243FE218000-memory.dmp

Filesize
32KB

Download
memory/2036-21-0x00000243FEA40000-0x00000243FEA4E000-memory.dmp

Filesize
56KB

Download
memory/2036-17-0x00000243FE1E0000-0x00000243FE1EA000-memory.dmp

Filesize
40KB

Download
memory/2036-16-0x00000243FEA50000-0x00000243FEA6A000-memory.dmp

Filesize
104KB

Download
memory/2036-15-0x00000243FFBE0000-0x00000243FFDBA000-memory.dmp

Filesize
1.9MB

Download
memory/2036-22-0x00000243FFA00000-0x00000243FFABA000-memory.dmp

Filesize
744KB

Download
memory/2036-23-0x00000244005B0000-0x0000024400B54000-memory.dmp

Filesize
5.6MB

Download
memory/2036-24-0x00000243FEA80000-0x00000243FEA88000-memory.dmp

Filesize
32KB

Download
memory/2036-28-0x00000243FF550000-0x00000243FF5A0000-memory.dmp

Filesize
320KB

Download
memory/2036-29-0x00007FFA38143000-0x00007FFA38145000-memory.dmp

Filesize
8KB

Download
memory/2036-0-0x00007FFA38143000-0x00007FFA38145000-memory.dmp

Filesize
8KB

Download
memory/2036-10-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-36-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-37-0x00000243FFDC0000-0x00000243FFE68000-memory.dmp

Filesize
672KB

Download
memory/2036-9-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-8-0x00000243FE1B0000-0x00000243FE1BC000-memory.dmp

Filesize
48KB

Download
memory/2036-7-0x00000243FE9E0000-0x00000243FEA2A000-memory.dmp

Filesize
296KB

Download
memory/2036-6-0x00000243FE1A0000-0x00000243FE1AC000-memory.dmp

Filesize
48KB

Download
memory/2036-62-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-63-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-65-0x0000024C007B0000-0x0000024C00F56000-memory.dmp

Filesize
7.6MB

Download
memory/2036-66-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-67-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-5-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-75-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-4-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-3-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-2-0x00007FFA38140000-0x00007FFA38C01000-memory.dmp

Filesize
10.8MB

Download
memory/2036-1-0x00000243FBFB0000-0x00000243FC332000-memory.dmp

Filesize
3.5MB

Download