hxxps://2rb8j[.]img[.]a[.]d[.]sendibm1[.]com/im/1675517/3dd7d3df29d5392cd33122a15a1cd0f24bffaaa843a3800a6e4be597bb1f7dba[.]png?e=IwNLHuGINlAK-5JYH1LWemolCJIOYmvcZAgbnij9GmUWALUU-a8Axh20uh16bKydYJusn_FunrcXVRzBTpVTv7c86uEL7d7V5ahWqr9kx6i8Nu9CF-kOBs6j_KZi8UmT2R5oPm8KB2HYvUmqviXEp3oVrw-5O-TEe8EQ2Sao8pS5m4co_6AL2w9hNxce0nYztpLZ

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2023 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://2rb8j.img.a.d.sendibm1.com/im/1675517/3dd7d3df29d5392cd33122a15a1cd0f24bffaaa843a3800a6e4be597bb1f7dba.png?e=IwNLHuGINlAK-5JYH1LWemolCJIOYmvcZAgbnij9GmUWALUU-a8Axh20uh16bKydYJusn_FunrcXVRzBTpVTv7c86uEL7d7V5ahWqr9kx6i8Nu9CF-kOBs6j_KZi8UmT2R5oPm8KB2HYvUmqviXEp3oVrw-5O-TEe8EQ2Sao8pS5m4co_6AL2w9hNxce0nYztpLZ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
4188	msedge.exe
4188	msedge.exe
2932	identity_helper.exe
2932	identity_helper.exe
5004	msedge.exe
5004	msedge.exe
5020	mspaint.exe
5020	mspaint.exe
4888	mspaint.exe
4888	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5020	mspaint.exe
1868	OpenWith.exe
4888	mspaint.exe
2240	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2424	4188	msedge.exe	22
PID 4188 wrote to memory of 2424	4188	msedge.exe	22
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2124	4188	msedge.exe	87
PID 4188 wrote to memory of 2728	4188	msedge.exe	88
PID 4188 wrote to memory of 2728	4188	msedge.exe	88
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89
PID 4188 wrote to memory of 3120	4188	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2rb8j.img.a.d.sendibm1.com/im/1675517/3dd7d3df29d5392cd33122a15a1cd0f24bffaaa843a3800a6e4be597bb1f7dba.png?e=IwNLHuGINlAK-5JYH1LWemolCJIOYmvcZAgbnij9GmUWALUU-a8Axh20uh16bKydYJusn_FunrcXVRzBTpVTv7c86uEL7d7V5ahWqr9kx6i8Nu9CF-kOBs6j_KZi8UmT2R5oPm8KB2HYvUmqviXEp3oVrw-5O-TEe8EQ2Sao8pS5m4co_6AL2w9hNxce0nYztpLZ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0b2c46f8,0x7fff0b2c4708,0x7fff0b2c4718
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15748596810070160334,13837552732186033672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:880

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\3dd7d3df29d5392cd33122a15a1cd0f24bffaaa843a3800a6e4be597bb1f7dba.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\3dd7d3df29d5392cd33122a15a1cd0f24bffaaa843a3800a6e4be597bb1f7dba.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f318f1c6c6f8c81dfd10c7cdde596004

SHA1
55fd828651a75c8213ad58a7a7a1054246a7bd07

SHA256
b671515f4c522ab35ef7399f3ed0cd629b307efb877bd7bd3ff63ae07ab19e1c

SHA512
53cd8179876358e2d7719cd3946f338d0aad19c228fe1ff98e84b2429babc219c7d9ec136631ce821a2937bc9013ab526ef6a0d78456ff5a1a1840c734f719ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec9265eb337757b9c17022933d22f75d

SHA1
52ca8d3072efaa57859df2f3ef3cc712941938c8

SHA256
c18b414b5b905aa2618bc21d31b190d857df926f86b695e3fd760113722735e0

SHA512
96ffc22afd472f39279e12d4b7cfa5f6e34b74152eb8f6e9d6dfe2b62dfff5121d494f4925bc351e09c6eed28d481f82064523922865af06ba37c806b25931ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2bf5a603030bc1e4d4258434609ba74b

SHA1
dd6c51e81ef27dbf77ea242ae236f83da4dbdb53

SHA256
1b0d107d71b96944f5bc89c3993d49047457a5ec8b0090b0b557a8f13d82d1d1

SHA512
5aed5488c6bb94363505f466178f8075613390e66b1ed20eba81b4deac09b8238124cf90c0f7764ff797731d2aa78339a462346fc1d1904b043236d3ffe13ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
92ab221cca8fc627bf2944bd53a2a5ce

SHA1
78cf239c60d2101adbc23aba2b1c6167ce182a13

SHA256
acc7c0c65d9e9e01c6aa3577f271ee2d1c9ba623c30aad265dfa4d6b18b7c5ee

SHA512
f4d59049bc1bc99f368db1093989e7daa729a2ffebb5462330e7930f443bcac07b47a13e345aa78e21bd808df5a7cd714b57ec174728a7d546d6a7820563c900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c427b8da6881b49054ef75383e49a8aa

SHA1
2728d018cdbf613b80c300477e9822087a9b44ae

SHA256
6db9ee3f29dca5f57ba7475b8c385585277408fa40309f5bc0f6147980bd6c76

SHA512
db1fc82924d177b9bcdb80655e0c3b950a30b645fd2aed7a8a8aa46056122f59b4f7d3eb0735d9709cfa5e058a6c4f29a9657384aea1a5de23ad7a7be0091351

Download Submit
C:\Users\Admin\Downloads\3dd7d3df29d5392cd33122a15a1cd0f24bffaaa843a3800a6e4be597bb1f7dba.png

Filesize
2KB

MD5
4a04a7c728fa256a8881bddc854cdbcb

SHA1
cbb994e9945631108b9a12afbb54ffc3e039b8ce

SHA256
fd95a4961f09396ff1fbbfc38c83667df93f3a4f4126144a2d8d7a32ae784890

SHA512
22523e1550ff1fa14ad3e46a3dd00f9cb1c7a11bc5197e1349b65244304f35a6a6631b300cb5fa0841bd112e765bd584d6a5a9be29e1d77d9934feaf389ad875

Download Submit
memory/1596-214-0x0000021F92860000-0x0000021F92861000-memory.dmp

Filesize
4KB

Download
memory/1596-218-0x0000021F928E0000-0x0000021F928E1000-memory.dmp

Filesize
4KB

Download
memory/1596-219-0x0000021F92970000-0x0000021F92971000-memory.dmp

Filesize
4KB

Download
memory/1596-220-0x0000021F92970000-0x0000021F92971000-memory.dmp

Filesize
4KB

Download
memory/1596-221-0x0000021F92980000-0x0000021F92981000-memory.dmp

Filesize
4KB

Download
memory/1596-222-0x0000021F92980000-0x0000021F92981000-memory.dmp

Filesize
4KB

Download
memory/1596-216-0x0000021F928E0000-0x0000021F928E1000-memory.dmp

Filesize
4KB

Download
memory/1596-207-0x0000021F8A5A0000-0x0000021F8A5B0000-memory.dmp

Filesize
64KB

Download
memory/1596-203-0x0000021F8A560000-0x0000021F8A570000-memory.dmp

Filesize
64KB

Download