hxxp://www14[.]baltimore[.]com/?tdfs=1&uid=1696513333[.]0249900000&sbox=0&kwl=Baltimore%20News%20Media%20Monitoring%20System%7CUtility%20Payment%20Processing%20Service%7CGovernment%20Payment%20Processing%7CSearchable%20Public%20Records%20Database%20Software%7CTax%20Document%20Management%20Software%7CTravel%20and%20Tourism%20Guide%7CGovernment%20Job%20Openings%7CBusiness%20Online%20Registration%20Platform%7CEvent%20Schedule%20Software%7C%7C

Analysis

max time kernel
209s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2023 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www14.baltimore.com/?tdfs=1&uid=1696513333.0249900000&sbox=0&kwl=Baltimore%20News%20Media%20Monitoring%20System%7CUtility%20Payment%20Processing%20Service%7CGovernment%20Payment%20Processing%7CSearchable%20Public%20Records%20Database%20Software%7CTax%20Document%20Management%20Software%7CTravel%20and%20Tourism%20Guide%7CGovernment%20Job%20Openings%7CBusiness%20Online%20Registration%20Platform%7CEvent%20Schedule%20Software%7C%7C

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1120	msedge.exe
1120	msedge.exe
2172	identity_helper.exe
2172	identity_helper.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4744	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4972	1120	msedge.exe	20
PID 1120 wrote to memory of 4972	1120	msedge.exe	20
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 4896	1120	msedge.exe	87
PID 1120 wrote to memory of 1368	1120	msedge.exe	86
PID 1120 wrote to memory of 1368	1120	msedge.exe	86
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88
PID 1120 wrote to memory of 3116	1120	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www14.baltimore.com/?tdfs=1&uid=1696513333.0249900000&sbox=0&kwl=Baltimore%20News%20Media%20Monitoring%20System%7CUtility%20Payment%20Processing%20Service%7CGovernment%20Payment%20Processing%7CSearchable%20Public%20Records%20Database%20Software%7CTax%20Document%20Management%20Software%7CTravel%20and%20Tourism%20Guide%7CGovernment%20Job%20Openings%7CBusiness%20Online%20Registration%20Platform%7CEvent%20Schedule%20Software%7C%7C
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd190a46f8,0x7ffd190a4708,0x7ffd190a4718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12024074459557594771,18039686321492909635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
320ffcb0c84370dea8f0fc7166ab7184

SHA1
1a4b62155018ea1062e4ccc2c04eaccf6212875e

SHA256
9ae5ddc1b843f5118611a5939950a2c644339191d9fdde56e955a3475273380e

SHA512
d51130c45f40929439a5124079d593108d2d5b7587b6ae7bbd747301bda33bbc22af2bcb2dc5c8614918abb17c57e6d0055ee2ce4762ce19fc284eab20a3c767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
1111a68447d9f9831a821c4ed4354a47

SHA1
bdb68c74e09b58fdf12044e4642155c5374cf138

SHA256
dee067eb4669b046111d787f9b62703da2f55db5c039433b8a378f9126182329

SHA512
828bf38f280d9c916244c678131903c9fcb2740fe047d373188e9cabebad90d8eba41fdf888e2c893f714afddf237b564f9c9c84e6a5de66969b689f17993788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
443319881835b14fda88caab9945e84c

SHA1
adb420bd20774e8eabc4d3d53ecfccb20ae7cb54

SHA256
fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da

SHA512
39c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
632c3c8ceb17e45210b4bee7b861ce15

SHA1
a3c5308087ef8f26cb69867b603547509864e2f7

SHA256
a5e1f73036e747a06d6e28741bba75bdb5bab029bb540eba9050ef594fce9fd6

SHA512
3639f4069b483e9e0f91dbf6cb51089061d83c60dcb46c958efdc8d8794bd1b800b52385c50baf68506876b39a2b02c39b6ec6fa60d25c3ab9ac3121a995f48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4e6a3dcebf2f2e90c056d110a7740d3

SHA1
8b0e488060f2344d93c5c4d48e00881dc951e55b

SHA256
6667789d312aec3b1485fb656dcfa0e1fedb4e75ede590dd72aacd87f48a4645

SHA512
b0cc6c3b1703709cade6418172aec01792106eb52202ad22e8e08ceae4447be1a9ef92bc6b4b6544509ad1af9653d8cf5d536236accb7df6987d5e116b53dc9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9fbe244bfade801d882a572b7d24acf9

SHA1
5cad8f40498aab3c50c0190350a50385e78e56e5

SHA256
68c921b9e8e51d70c3136ab62f226f813f139cf1fdc07b93a6d6fdac2f5a4cf6

SHA512
5a6cbf85915347df42ff659ab39057e86e2d6bcbccc4b98450ba28aa684810e2cc07cd093a5b5af445960c956bf7ded0b5ff1d3ed33e68abbc62a6888e6767c9

Download Submit
memory/4744-181-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-187-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-178-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-179-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-180-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-161-0x000001EE6A840000-0x000001EE6A850000-memory.dmp

Filesize
64KB

Download
memory/4744-182-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-183-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-184-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-185-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-186-0x000001EE72E60000-0x000001EE72E61000-memory.dmp

Filesize
4KB

Download
memory/4744-177-0x000001EE72E30000-0x000001EE72E31000-memory.dmp

Filesize
4KB

Download
memory/4744-188-0x000001EE72A80000-0x000001EE72A81000-memory.dmp

Filesize
4KB

Download
memory/4744-189-0x000001EE72A70000-0x000001EE72A71000-memory.dmp

Filesize
4KB

Download
memory/4744-191-0x000001EE72A80000-0x000001EE72A81000-memory.dmp

Filesize
4KB

Download
memory/4744-194-0x000001EE72A70000-0x000001EE72A71000-memory.dmp

Filesize
4KB

Download
memory/4744-197-0x000001EE729B0000-0x000001EE729B1000-memory.dmp

Filesize
4KB

Download
memory/4744-145-0x000001EE6A740000-0x000001EE6A750000-memory.dmp

Filesize
64KB

Download
memory/4744-209-0x000001EE72BB0000-0x000001EE72BB1000-memory.dmp

Filesize
4KB

Download
memory/4744-211-0x000001EE72BC0000-0x000001EE72BC1000-memory.dmp

Filesize
4KB

Download
memory/4744-212-0x000001EE72BC0000-0x000001EE72BC1000-memory.dmp

Filesize
4KB

Download
memory/4744-213-0x000001EE72CD0000-0x000001EE72CD1000-memory.dmp

Filesize
4KB

Download