hxxps://t[.]ly/Divadlo-Arena2111

Resubmissions

22/11/2024, 10:07

241122-l56graymdz 10

22/11/2024, 09:56

241122-lyg6ksyldz 3

Analysis

max time kernel
72s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/Divadlo-Arena2111

Score

10^/10

discovery persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2440 created 2488	2440	Dôkazy o porušení práv duševného vlastníctva.exe	45

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*UpdaterCisco = "rundll32.exe C:\\Users\\Admin\\Documents\\AvivaUpdate_0001.dll,EntryPoint"	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	2440	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dôkazy o porušení práv duševného vlastníctva.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dôkazy o porušení práv duševného vlastníctva.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
664	msedge.exe
664	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
5044	msedge.exe
5044	msedge.exe
2440	Dôkazy o porušení práv duševného vlastníctva.exe
2440	Dôkazy o porušení práv duševného vlastníctva.exe
2440	Dôkazy o porušení práv duševného vlastníctva.exe
2440	Dôkazy o porušení práv duševného vlastníctva.exe
4520	svchost.exe
4520	svchost.exe
4520	svchost.exe
4520	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 4860	664	msedge.exe	82
PID 664 wrote to memory of 4860	664	msedge.exe	82
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3560	664	msedge.exe	83
PID 664 wrote to memory of 3532	664	msedge.exe	84
PID 664 wrote to memory of 3532	664	msedge.exe	84
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85
PID 664 wrote to memory of 1136	664	msedge.exe	85

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2488
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://t.ly/Divadlo-Arena2111
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff877f846f8,0x7ff877f84708,0x7ff877f84718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4068 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,10786817143204217299,13992133896198678803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4084

C:\Users\Admin\Downloads\Dôkazy o porušení práv duševného vlastníctva\Dôkazy o porušení práv duševného vlastníctva.exe
"C:\Users\Admin\Downloads\Dôkazy o porušení práv duševného vlastníctva\Dôkazy o porušení práv duševného vlastníctva.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1456
- C:\Users\Admin\Downloads\Dôkazy o porušení práv duševného vlastníctva\Dôkazy o porušení práv duševného vlastníctva.exe
  "C:\Users\Admin\Downloads\Dôkazy o porušení práv duševného vlastníctva\Dôkazy o porušení práv duševného vlastníctva.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 392
    3⤵
    - Program crash
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\AvivaUpdate_0001.dll",EntryPoint /f & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:756
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\AvivaUpdate_0001.dll",EntryPoint /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2440 -ip 2440
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
357B

MD5
849a68be50c73e08cc0715a2f05771fb

SHA1
4aa6daa78198549ae82bac2bda969e0d6f5429e4

SHA256
d5adf251df130fc5a10ca50285a54c5d23d30d233a3aa209f9880d198e75153c

SHA512
e31863a6f29d93e314f42341957450067f5e63418187f8772872a7980794c1711cc912161ea305e7b06e432086fa4cfb9b0f38d31472236537f6ca012ec5869c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96b83eb426c91f9b7c4417c12af3382f

SHA1
3e8a6ae2e5672aa9047e9662853dcff51dff912c

SHA256
2ddf4566cf63c63e6e3275ba4afe2024b3c922e13bafbb761b6168f6a6bbb048

SHA512
fb1c3d2411b6d64009f17a4e706dd80470e7dc95ce51684d985b89c1d09ee56d2cb87645d00aeef1556f1121d57f80a0fc17b137994494b079987659849d8f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e8137f92e6ac4a8952abdfae2ddf8ef

SHA1
aacf4efd7197a895b9de61a46f459238ea713fd7

SHA256
79d970591b0e0df133e97ad5bf91b55b78abdca55b39d65d7207944b05d10151

SHA512
439e9a3bd3adc7b3585ce10cdfa4417832d45f16fef642604ecd19c30a49bd81794c1fe57ebf7be127129892e1e9531b28f9fc87f8c46ac9f34e21b5aec01a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62f396d7826603ee0bada182b39fa6de

SHA1
fec6c5453bc657877bc8cca904d5e03b72e61ab4

SHA256
18b855361277d3dbc01b6a3750db8846fbf1ca2d93f852c7a9ac04230d4267e1

SHA512
13a91a3bff8b18da04b60c440c78c182720743adeb76dc6f5244d24882496d069129771e57eea8a0d5bbaa1b2ce07b351e63b786b92be533c0f30b33c31ec3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf0fa8990f8faa303f2741ea880d27f8

SHA1
316c38856217edd6cd53c27f02f658cc3231f057

SHA256
5ec96221d7c964a5ef9b3e539772c18952fc32b17c86df62d0fe261ff2369e61

SHA512
f5eab7136828cf20a3a8e179f154437356dbeb6a1b43c0707000458896199d1a50f68a6f9f7b51af2ab08a45712ab4528edd0ae0232aa0f0ebb9dd34ac301f63

Download Submit
memory/1456-93-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/2440-100-0x0000000000A30000-0x0000000000AB1000-memory.dmp

Filesize
516KB

Download
memory/2440-102-0x0000000001050000-0x0000000001450000-memory.dmp

Filesize
4.0MB

Download
memory/2440-103-0x0000000001050000-0x0000000001450000-memory.dmp

Filesize
4.0MB

Download
memory/2440-106-0x0000000075180000-0x0000000075395000-memory.dmp

Filesize
2.1MB

Download
memory/2440-104-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

Filesize
2.0MB

Download
memory/2440-97-0x0000000000A30000-0x0000000000AB1000-memory.dmp

Filesize
516KB

Download
memory/4520-107-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/4520-110-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

Filesize
2.0MB

Download
memory/4520-112-0x0000000075180000-0x0000000075395000-memory.dmp

Filesize
2.1MB

Download
memory/4520-109-0x00000000012E0000-0x00000000016E0000-memory.dmp

Filesize
4.0MB

Download