7d778a0e2fc9a0ea7992aa32d15751a11d1932922003c36bcad6460205f0e688

Analysis

max time kernel
98s
max time network
147s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-11-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SeroXen/SeroXen Documentation and TOS.pdf
Size

389KB
MD5

268a35fc151093712fd931438266733b
SHA1

0cfe4de8b721ae00275f171874e975143ba4e5c3
SHA256

f3329fc8e298719361d0799fd3aa160ccc860fad1cdbf2d5b920370561079d24
SHA512

60f12acab903f4213b2e6f96e0e4ef4d19b4378d0cd18e86b736e1ef4daecbf18f926d298a60e156fce06d4af4121636133cc87d61ce7aed815e66240ed2cc03
SSDEEP

6144:gHN9PzWipJ6LIgy6WW9OyfnFTGndbcF7pVEtiOTwl/BdGqgZzu6cXmnV:saqcLIgySDYdbcJ/Etol2zu6dV

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6245e60d-3ecc-4404-b2ad-40d7c62a790e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241103144056.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
5180	cmd.exe
2920	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid	Process
3524	taskkill.exe
4120	taskkill.exe
4736	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2920	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid	Process
3832	msedge.exe
3832	msedge.exe
1684	msedge.exe
1684	msedge.exe
1972	identity_helper.exe
1972	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exe

description	pid	Process
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid	Process
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exemsedge.exe

description	pid	Process	procid_target
PID 4880 wrote to memory of 1684	4880	cmd.exe	82
PID 4880 wrote to memory of 1684	4880	cmd.exe	82
PID 1684 wrote to memory of 1140	1684	msedge.exe	84
PID 1684 wrote to memory of 1140	1684	msedge.exe	84
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 1916	1684	msedge.exe	85
PID 1684 wrote to memory of 3832	1684	msedge.exe	86
PID 1684 wrote to memory of 3832	1684	msedge.exe	86
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87
PID 1684 wrote to memory of 4800	1684	msedge.exe	87

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SeroXen\SeroXen Documentation and TOS.pdf"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\SeroXen\SeroXen Documentation and TOS.pdf
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffa8b8546f8,0x7ffa8b854708,0x7ffa8b854718
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5528 /prefetch:6
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:8
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7bb805460,0x7ff7bb805470,0x7ff7bb805480
      4⤵
      PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17742254446048783018,5265692103581675885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
    3⤵
    PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5832

C:\Users\Admin\AppData\Local\Temp\SeroXen\SeroXen.exe
"C:\Users\Admin\AppData\Local\Temp\SeroXen\SeroXen.exe"
1⤵
PID:5928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 4 > nul & taskill /F /IM "SeroXen.exe" & taskill /F /IM "SeroXen HWID Reset.exe" & taskill /F /IM "SeroXen Toolkit.exe" & rmdir /s /q %userprofile%\AppData\Local\SeroXen & rmdir /s /q %userprofile%\AppData\Local\SeroXen & del /f %userprofile%\Desktop\SeroXen.lnk & taskkill /F /IM "SeroXen.exe" & taskkill /F /IM "SeroXen HWID Reset.exe" & taskkill /F /IM "SeroXen Toolkit.exe" & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\SeroXen" & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\SeroXen" & exit
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5180
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2920
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "SeroXen.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "SeroXen HWID Reset.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "SeroXen Toolkit.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57ba67.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5abd1dcfbcdfb7e436717ce19015aa0f

SHA1
b753c5551a075e4fdb1b0e7bc30c2a302e40e1c3

SHA256
b706713dfe990603ece617f1724d711f20449322bb2357cf44b0c091ef2a9f97

SHA512
59b6faef6d00e92421600691a61758a35aacb816135353fd8db031769dbf96274f5231c11f9cfd89c34f868420d48be571f33991e16c9d7652e50d59bfb760a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8baebec7832270acdcb9ba70998d80dd

SHA1
af993c6b0b57a42402ca580d13058b4abd8f64e7

SHA256
b6a7bdaf460bf822f9e5270c365b3227b7d6dc7719a495779eafcd56db1fe8d3

SHA512
bc427aef5b2be6be9d1238d9dbcdc80e149806913e31beae7c5c62067238342756837cfdcc1a31ffaa3e29ef586a55ba24206ecbc718144615e327ff863ffdc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35d5696736aa320f19ad6913418dbdc0

SHA1
5b1ad34473caa4e127adad06d1f51ec8c461c5e0

SHA256
966d2c1f8d0db179314bf4bd048a0477f37f089b3062107f428beb3ce5f6982f

SHA512
1bdf1ed98052224bf839b5f36f4c57db75b5743fa24d62744ee97e48c2d61fed034dac6ded586a137e7f317e22fac0d94d174cf4ecace418df0a0fac0f4a0a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6d3458c230e0e4d1752698287bf9e835

SHA1
f99e0a8398062f7dacf5bf785cc800b6816e185d

SHA256
29cde337933ffe533f192ab094e03fc1777b6d840c337991f9450625e248f7b2

SHA512
ee50fcfc09f520ae62668530bdbb4974556582705b866a0b68b4f84120db481fabe381d0f6e26f451caebc354bfe7d0374043ff8f19157194e2787ae144db3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0887f25fad362844deeaf5c4ed53f043

SHA1
b4b5e7cd66c44b28bee1d3f81f85e3c76c3569cc

SHA256
9585541c0edb13e17728e0f4ef6005ea5c325d1da5781d3b6f9725a1c2ba6a28

SHA512
b8c5f88fe38daa415bcb14e07f7103952b83cb09625e3881fb6f18f9ce90240ee2a57aee225640b5868971b65bdda1c2dd35a32a1d498fadffe4748a560c5f1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a9e10b5722ef0d4cad2aa3ee48fb17c3

SHA1
0d9411df9f37f42adb92b222b2183da93f590fab

SHA256
21a082c2d37b35744494a47846604f8709ddc83de04c022426ba93f43c3d4f65

SHA512
1d7d1d437f78e7b83f594bb243fd70ae6d8077e29ef8b56e19fca436dc52b1d9676f07c6fe1a31fc715cdc8bda0f8dc1bfd448e2438a97e9e32a6c060cec4974

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2543e82ec4284cee129abf95c3a7d6bb

SHA1
9abd6abd8e38f0c7c04a4c5db93de0d337409963

SHA256
89e83570e7a4a372ad9128db6ae87e6f171cec6dc1a54ea398c774a883059605

SHA512
32a0e2a9634cd64dc54b0b5e3c23530669441a768800062f8c87acc2d883b044faab79bfa69f656a2bb85e9d9c1604f15e513d2d5ef7eceddd6cae1ec59c6673

Download Submit
\??\pipe\LOCAL\crashpad_1684_YMCPFREWCYKQHBJL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5928-319-0x000002A3E99C0000-0x000002A3E9A1A000-memory.dmp

Filesize
360KB

Download
memory/5928-320-0x000002A3EB640000-0x000002A3EB67C000-memory.dmp

Filesize
240KB

Download
memory/5928-321-0x000002A3EB6F0000-0x000002A3EB72E000-memory.dmp

Filesize
248KB

Download