507641e3047216809af93a127af70a266e273cd95c1cfaa06605a753b9166388

Resubmissions

07-11-2024 21:24

241107-z8z12ayfnb 8

07-11-2024 21:23

241107-z8jdaa1pdl 6

07-11-2024 21:21

241107-z7ptnsyjdx 7

Analysis

max time kernel
1688s
max time network
1695s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-11-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Delta V3.61/Delta.exe
Size

17.0MB
MD5

774ffee84d8e760761b8819edd2bc252
SHA1

74ff2bcc3baf64790181b97dc09ab951d9440379
SHA256

3c2cbcfb0dc0b92e1a0f15e725a1f8c4756a990e298098d94087cdd3fd491758
SHA512

935624fdaa9ae57d4515a456a9383c20240988848046fcab69948450413e573167c0f17a456f0f5120ec13e3215759ad11c4857873900606116c3e495dd69650
SSDEEP

196608:LOM8QZXcqPrn0guhegnueaIN3l4X+yBXeLUpcgwBj9aR:LOM8EmegnBaS1C+yBaUpcgwBj0

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	discord.com
25	discord.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241107212233.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\551f9083-f929-40dd-ba6e-315b39580295.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delta.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1361837696-2276465416-1936241636-1000\{8FA0C45D-B4FB-403D-8FC9-29C8021AE056}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
2688	msedge.exe
2688	msedge.exe
4092	msedge.exe
4092	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	Delta.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2688	4936	Delta.exe	86
PID 4936 wrote to memory of 2688	4936	Delta.exe	86
PID 2688 wrote to memory of 1876	2688	msedge.exe	87
PID 2688 wrote to memory of 1876	2688	msedge.exe	87
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 3992	2688	msedge.exe	88
PID 2688 wrote to memory of 1128	2688	msedge.exe	89
PID 2688 wrote to memory of 1128	2688	msedge.exe	89
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90
PID 2688 wrote to memory of 848	2688	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\Delta V3.61\Delta.exe
"C:\Users\Admin\AppData\Local\Temp\Delta V3.61\Delta.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4TfpR6wUUu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff261346f8,0x7fff26134708,0x7fff26134718
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4136 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4308 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x11c,0x110,0x260,0x124,0x7ff6bf385460,0x7ff6bf385470,0x7ff6bf385480
      4⤵
      PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15588263660007135721,10591057425386601863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78bc0ec5146f28b496567487b9233baf

SHA1
4b1794d6cbe18501a7745d9559aa91d0cb2a19c1

SHA256
f5e3afb09ca12cd22dd69c753ea12e85e9bf369df29e2b23e0149e16f946f109

SHA512
0561cbabde95e6b949f46deda7389fbe52c87bedeb520b88764f1020d42aa2c06adee63a7d416aad2b85dc332e6b6d2d045185c65ec8c2c60beac1f072ca184a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a134f1844e0964bb17172c44ded4030f

SHA1
853de9d2c79d58138933a0b8cf76738e4b951d7e

SHA256
50f5a3aaba6fcbddddec498e157e3341f432998c698b96a4181f1c0239176589

SHA512
c124952f29503922dce11cf04c863966ac31f4445304c1412d584761f90f7964f3a150e32d95c1927442d4fa73549c67757a26d50a9995e14b96787df28f18b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
cd5b5837f1e632878f78f5356d3f5ae2

SHA1
4880abaf506179e6fb15315d294f7eca9aa60081

SHA256
b6a0e81da6ee6b98c462fb563beaa058b04b4d65d7433ad78aa4b8ffe231f266

SHA512
c60be94b9d8d17387c607a63b7516e034e9c82b85c5b82cfba5c65eafdffd8b8e549380447383971db6052c8f6c5d81a74774c88eaa8466ee5a63606e2c35502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
9f8c1b2f4643d0fb133e168da0c7c6ca

SHA1
2043b2a88d443c874211b065bd13b250a13b7589

SHA256
db6d00b751cac4e66e2e4b17af41163e21dd389b351fafe8e25c724398791927

SHA512
483740904bb01e733491fec35bff123d33eff80d7145b17502f9ac3cc40df6f1d76af2f9e7037b376a057f64dffa0ca7eb7323a73564fa8ee8b9de61cd456f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
ab09ed3f07005c172ad1ab26fac97f8b

SHA1
957d7d60b2b2011eb7d6f67f08da8de30b72aaa7

SHA256
2300e04f3b5882aca4b40cda1c774b3f96982adfb0766943cdb82292c2e75932

SHA512
df17fd3a0a15c19af70c67417329bfda789a70abbedf3bb3994c0f8c0dd0819fd111770c8a673749400ceeddb1e3a06d5c0bb985b9a03b690932a4076081e57c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f9c0d7c96f7dc0c0af841ead993294b

SHA1
b810ea7720d5d3ac670a03ee51a00cd1f20363d6

SHA256
4a42d19387bc845ee040ff6d50379bfcb6871312b7a8dd9c618215285ec5353e

SHA512
b0963fd9dd57f4339584da1262df2d14b5d5d310892665724591736a6161cc92b96f406e6da50b1ba6e4605e665fb2599c04b71cb0a61e0d554d14c03bcb3858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
81039ac8bce69af85d574c6e3ef6ef89

SHA1
98f832ae235d9d2c217d0fbf2ea53fa30cc840c4

SHA256
7ded5434607e7675496d68ac60cd7aad5452ae4ac36ff29763cca991464df0e5

SHA512
4698c73066b58cc70d282fdfaea68b9e4407dfe8c2b9ed109d8837a93698367314658f8db994667b0fc670c8f6612db75bd341372b78826008b029fd17433271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2290aaf2bba8262a35737301d7262f6c

SHA1
ffb3437e5c247342a804c3f0c9711a3f243292ce

SHA256
e49d86826ece29d676c3fc61b618c1f63a925aa11ffd2600fae543e6ce9b7906

SHA512
7646c85d8b534ea36b3b6d04cf77264127ffe938ef86be6492eb2089d6cf73d529833502d249e5c713dde16ba5a729584b276c05dfe15c128554575edc40ff4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9010fe212d7da97a4e9cf63a903ee7a4

SHA1
8f124a736d045eea3c50a9597d18c9af8b128e28

SHA256
c2956b77f9af9f4d79e0198d8a7e0a5b6f880b4d597dfeee25a3f56c05d11834

SHA512
f763ab3261592107fb19b7d6134c7f4d02e921258b1c72f1e0c69a95ee8ed9cc20498259a279cca9648bbd213a5234b965a9196865d465e1f975ee9242e36326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
21320325bdfc20c6f4e4d136228fc9c5

SHA1
7e96950811d7ddbc1daeb7341ddb9768980bf2b5

SHA256
5e7ac2b978206a07d8b1841a2bd89eae4b466bcd8a0df3a62ae2ca0439b8bd5e

SHA512
ee78316d5b8edffdc83e3431bdbd28ae05a481d2a445ddf3b7c58bf0f01c6c42aead46a4d91e7fc75519a5ca8a7e2bab78749d88476c7a2fa0a25e8b3592bd43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d5bbcbaac77f22aae0fc9e0bcac846ca

SHA1
fbfbe6a988ef862d170309217bb8179f0c4d23c8

SHA256
7e69b098ea7aa981e15363a2aedc554a6e9e0b4604e89fd6c1271c781fffb653

SHA512
041922f62a009207c51078bcd5425bf85ab715fedef3ec5b9c18e3b45ab00fc4efde817000d12120416dae092748313f9605a50cc0af9ad54f3fca7d31290ae7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8829fba5f1f17459cb72ea2f8a20c425

SHA1
0f67aa7a1003a0bf5c2044fee2c45da6c6ac624a

SHA256
00ece5a7b9aa22f767509a2c09793a25dc972523844d6f04592a7e9b9f5dd14f

SHA512
23d21432a77b9143d24b26d6196c57fe076d26da739d444b95599e9174a776c1fe0af9f5620ea1e8f3ad4d35b68f4b5615f2432e769e69b8280bc73170e9cde3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b1574dc9bd25965f33387c63e386c87d

SHA1
cbdd9e3ab564ce5eef230d2279d4a17ba45f94cf

SHA256
ea535b5a8cd763fd6abbd566a64311a1f8809579017328aabf2734b5af0d0af1

SHA512
6131f25a9e4e1ed8e7ccf340e05625efc6004a457dee67524d21f36f7d1d70621842b8fe12e2c67993cea3cb4137a03826bbaa22fdca55b63353ffebb7abe50f

Download Submit
memory/4936-134-0x0000000075080000-0x0000000075831000-memory.dmp

Filesize
7.7MB

Download
memory/4936-15-0x0000000075080000-0x0000000075831000-memory.dmp

Filesize
7.7MB

Download
memory/4936-11-0x0000000007650000-0x0000000007672000-memory.dmp

Filesize
136KB

Download
memory/4936-8-0x00000000076A0000-0x0000000007716000-memory.dmp

Filesize
472KB

Download
memory/4936-130-0x000000007508E000-0x000000007508F000-memory.dmp

Filesize
4KB

Download
memory/4936-16-0x000000000D1C0000-0x000000000D1C8000-memory.dmp

Filesize
32KB

Download
memory/4936-13-0x0000000007BD0000-0x0000000007F27000-memory.dmp

Filesize
3.3MB

Download
memory/4936-14-0x0000000008040000-0x00000000080DC000-memory.dmp

Filesize
624KB

Download
memory/4936-0-0x000000007508E000-0x000000007508F000-memory.dmp

Filesize
4KB

Download
memory/4936-12-0x0000000007720000-0x000000000773E000-memory.dmp

Filesize
120KB

Download
memory/4936-7-0x0000000007230000-0x00000000072E0000-memory.dmp

Filesize
704KB

Download
memory/4936-6-0x0000000007000000-0x000000000700E000-memory.dmp

Filesize
56KB

Download
memory/4936-5-0x0000000007040000-0x0000000007078000-memory.dmp

Filesize
224KB

Download
memory/4936-4-0x0000000006FF0000-0x0000000006FF8000-memory.dmp

Filesize
32KB

Download
memory/4936-3-0x0000000075080000-0x0000000075831000-memory.dmp

Filesize
7.7MB

Download
memory/4936-2-0x0000000075080000-0x0000000075831000-memory.dmp

Filesize
7.7MB

Download
memory/4936-1-0x00000000008B0000-0x00000000019B6000-memory.dmp

Filesize
17.0MB

Download