hxxps://emmaward[.]nl/css/pjgfguyt6776u[.]html#secretary@bspd[.]co[.]uk

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://emmaward.nl/css/pjgfguyt6776u.html#[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1804 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
364	msedge.exe
364	msedge.exe
5040	msedge.exe
5040	msedge.exe
2852	identity_helper.exe
2852	identity_helper.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

5040 msedge.exe
5040 msedge.exe
5040 msedge.exe
5040 msedge.exe
5040 msedge.exe
5040 msedge.exe
5040 msedge.exe
5040 msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

msedge.exe

pid	process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE
1804	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5040 wrote to memory of 448	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 448	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 4924	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 364	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 364	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1048	5040	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://emmaward.nl/css/pjgfguyt6776u.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc41a46f8,0x7ffdc41a4708,0x7ffdc41a4718
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
2⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
2⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
2⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10989146164686791583,11340336209944788260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4704 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\StartPublish.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
26b67b7d9bc85421270f4ad84006db90

SHA1
d5817ddaf1d5c9ccc5d5760725e84498d943998d

SHA256
d826a1ecfe4608753f31e6b630a174cce526e716ba1a986fb466260520030527

SHA512
460d8320367cf7b74bd6f8f66a7caaeecddd8fd7054e6cbc0bd510c4cf68d7038f4d2d8c79ad36905a27561199799620db616d347bd74e640f32cedf7093af62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
0436d42bec7ea0c9cf6d56d53b4de94c

SHA1
651c5e75965d2482be702e470410ee206cada3c6

SHA256
be21a3f8a381ef9cbc31c01341948eeb8e13bdb0efa03c7a896b4f2cb27235df

SHA512
e7359bdc197c867fc51dcb18e9feb6ffdde4735045e26b931942c03d817a4bdce0026025f82d0bb9ee9254e74c5e66e10fc35eb710f61c53b2a1ae20d66e446e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
119b3f0fcc91072d6b8c714a763ea489

SHA1
3aec5ba45ce4498c57e807d347c06c8cf5513bed

SHA256
654db1831b502feee4dae196f85b61f28a360494621b5cfc65dfe91cd3043d0f

SHA512
335338b701052bea213e996668fe281d90489a71df867d607da57702b547ec35bd8385b90dbc69b2e23279b7939e978cea7f73621d45fcc7c95306dfaae52951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d4a0a3977ecf3a6d0d8adaf6c671e8b

SHA1
3a63f0e2e4950dfd810529df9f9bae3431877e46

SHA256
0b3a8164cccbeaf5bc9621310f825b5b1562f9423bcfbcc7d63efe708ef4e872

SHA512
4fcf6e126fad63218b7b47f33316a20237bdd0ceb983da13b7832e1b6237225cf0b480851d40d421c8853ccda078687c640633ab9f0eed6f3501f47ae132a6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0695f3e5da0fab4e3ebdad614e50bc7

SHA1
81f70784e0a737cc12cce3e245f69f30513c3074

SHA256
37e957ceb01844f2622e7527f4b25e975e235f8a544df7da249cabfaafa963f8

SHA512
875c02b38fc37431e3ab3fdc5377e62c67aa7ff3199464e7decf98da67fd402e333a3b0224e80fc8cc1f11163a96a20337a9bdd7be46e1d4dca33c01b281a8ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdb5cafa0261c18fc60b4b72dbe851a0

SHA1
60c9c2956eabcae62cfe0eea669a3b84ba81bf62

SHA256
c0f7a30d203d330c1e656c026b4c4a8a9fe0c2d77fe5987e307f385265cff373

SHA512
a191e89260992cd6adab7954b64cf432c0d0014a855bd9fd65c5be0714a528d1329d0d5d4cc41183617933f3ccfd78021d132799016c468beec6bbfbf737b0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
668ddef326060bd77d601cddef71386f

SHA1
945c0cc68daff764b6198b11eb5b68ac4a3d28c5

SHA256
2df75c1f01b532e24eaba9df56d0e7b3bdd1bd17b98bf01e9b89fe0f18fbf345

SHA512
cbcf26dcc44de44ef44dfee3ae220e5401d44ee19308d54053090009d2d252cab0d5c576365e9f1e309b10e2c993f95f11984bbd463f780625de33a84652baf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb044563541dc0ffb61b64543bcd8310

SHA1
f0de0384b2ea09388d3cc5dbf0506d61073e382c

SHA256
45b69461b94a7567196a14aa6619362101a9904776a62ff82d344bbc254b36c0

SHA512
cc8c32414eb509f41d96da4a8a2c44366b864b3c0c2b40b5c6e7312c49ef03efabc21133c88799241ae9176bee05c8dddc898929643ca69436cb40b602e61e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f56c.TMP

Filesize
539B

MD5
d9f7635ae01e4a8a433d65d98a2b852f

SHA1
778cb28cf4345144d3ca1ae14b3b68662e918dcf

SHA256
faa796ca8fb80af60f8817768760b5ce77da9c74dba965702ab6d27bedc41069

SHA512
71c4f9243c829b1e9f83167974b97e964141ef7545202e8549886ab2afc4c08180b216d4ab476f334ad438067114d34580fa153b2e50007ac0a41c79aee26ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
90a8c031e50d4574d62ad2dadae23449

SHA1
7a36443745fc251965bbbb1272e82c57003c4242

SHA256
f0033825e0788a49f40bd1ccb79a5e8e6bdcb09120e318636c629d62bd93e9c2

SHA512
aba75c14d0d339fe8cf426c6c0b769ba26b0c68ff9f74d86d0cc52264e5c0bc088e13b96ea30cf17c0f85360a589b0ae7f0bb3ce26ce706d0043b33cfa7a11ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f2a9a339777840baae1452b8ff32a42

SHA1
21f0edc2f0cea8d5b485f78f763df80e0b5fd877

SHA256
3369686f73ef5673c35fdfdd203c925625e5238c4f5df5beb0c8c8a809078b79

SHA512
940e443e2e72523dc0caa486689a59d9df59b4a02b00c4e50f2d5ecebda2460e2b1fa84827f537c9ee9df7ff2bd12c9330365d2040d6fcb0ed7ec6b8e79d38e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
b912259fce425602b77fbe01fb34dde0

SHA1
24c126679834dd8ece9878bedbdee3fcf924a8d9

SHA256
a192eeabd7a3e234221d5dd34ce7bfe32fc2450b3573674fd379dbfca62bd95f

SHA512
d3e1d6fe14dbf61b34477f630ddaf65199b471994ebbd11d6c9328e7c9efac6e3b9fcaf9beb9b388f334df8a60e0c3ab27fe783122b3cd4870bef0e29a1b2f93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
253B

MD5
15aa1c6d15787586220288f0783e25dd

SHA1
6f856ce21c97a2f59a38fd7463b8dd5c0e6cf971

SHA256
c3b13f76a1851ed243986c97c7377b2c529978f2c20edd4a5ef1e8963629a0ac

SHA512
6a53fbd98695a403511815a143cc2a5c6469768474ce71e12ac5a614f2e441b5fcda5b464ea9ac49d0f14412d0201ac7d94316f4a24a912703a58b2ba0210632

Download Submit
\??\pipe\LOCAL\crashpad_5040_FDRUPLYLIJNQHOBY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1804-182-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-183-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

Filesize
64KB

Download
memory/1804-184-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

Filesize
64KB

Download
memory/1804-179-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-181-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-178-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-180-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-233-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-236-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-235-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download
memory/1804-234-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Filesize
64KB

Download