hxxps://cdn[.]discordapp[.]com/attachments/1158366716196290620/1214885996500353074/240305-1qnqqabd84_pw_infected[.]zip?ex=65fabdc1&is=65e848c1&hm=5924702bd5182685a5ce8ab91a889ddc0e94ceed3ad3923cc945e571ed4f93b3&

Resubmissions

06/03/2024, 11:10

240306-m93gbsaf53 5

06/03/2024, 11:00

240306-m35m4sae94 1

06/03/2024, 10:56

240306-m1t4laae64 4

06/03/2024, 10:43

240306-msrnhaad52 5

Analysis

max time kernel
71s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1158366716196290620/1214885996500353074/240305-1qnqqabd84_pw_infected.zip?ex=65fabdc1&is=65e848c1&hm=5924702bd5182685a5ce8ab91a889ddc0e94ceed3ad3923cc945e571ed4f93b3&

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
3008	msedge.exe
3008	msedge.exe
436	identity_helper.exe
436	identity_helper.exe
1948	msedge.exe
1948	msedge.exe
5432	mspaint.exe
5432	mspaint.exe
3644	mspaint.exe
3644	mspaint.exe
5152	mspaint.exe
5152	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5732	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5504	7zG.exe
Token: 35	5504	7zG.exe
Token: SeSecurityPrivilege	5504	7zG.exe
Token: SeSecurityPrivilege	5504	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
5504	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5432	mspaint.exe
5812	OpenWith.exe
3644	mspaint.exe
5732	OpenWith.exe
5152	mspaint.exe
1152	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 668	3008	msedge.exe	90
PID 3008 wrote to memory of 668	3008	msedge.exe	90
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 3088	3008	msedge.exe	91
PID 3008 wrote to memory of 2092	3008	msedge.exe	92
PID 3008 wrote to memory of 2092	3008	msedge.exe	92
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93
PID 3008 wrote to memory of 3816	3008	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1158366716196290620/1214885996500353074/240305-1qnqqabd84_pw_infected.zip?ex=65fabdc1&is=65e848c1&hm=5924702bd5182685a5ce8ab91a889ddc0e94ceed3ad3923cc945e571ed4f93b3&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa068b46f8,0x7ffa068b4708,0x7ffa068b4718
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8939758168086262622,13723828801277573584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:232

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected\" -ad -an -ai#7zMap29797:120:7zEvent4876
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5504

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected\download_3.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5812

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected\download_3.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5732

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected\download_3.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41d7f89d40aefe0b98179355959e1200

SHA1
6b0bc6be8a1355f5eed160f70cb4e2129d2fe803

SHA256
3db2f991eaa0a84b462b45da955f9bbe67fcc9150c0264a732ba86e82ed1ce41

SHA512
68be74605b5c75bfb24b223d76628cb3fa7ac427cd992110b1722f2b038d0cf36f1ad42e1b837a70b82e387aef57feec9df47df4901c1f34bb24b8bd3fa89b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f50f1c356ecd4c1aef0e29f57c1ed22

SHA1
cd5eef75efe81a920baf224b032c12d6dde1c142

SHA256
5b5a51a34729e838eefdce8646987affdede1bfe5901ae2d2c28c9ab13234247

SHA512
173710d72a73f3be2b90e72809a5cc6a96aa574f1a92d2623009b3bc9af1c252e316dc655d5cbcb41c4f2988fbc6f83a952973ecf7a4ca794cd4e77a96a1b53f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
803534d90d363f26e55d27b79e826bb6

SHA1
9e509a5833fff25f2f720b846559e87ffcf533d5

SHA256
e389631f91b73d3164c801cf2008c2460a72e9f24b2e94dbec7112c9ae4d9a8a

SHA512
71237768a7e03d108d9d433a93287bce1f9d995c239dda621377f48bc1ef1eb097438e1afa2252cf381fa77da1f6b159bb71c0c5b38cab93441a7f75ccdc762c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af4051a9de157a0c8f784ef39a743b81

SHA1
77971e16b2032bcc5ee7cc8bbe85149eb5a7fcef

SHA256
4c5d10b123b7f676c0243a5dcbd931e4e1e41232031d7fc02a67e93df2dc982c

SHA512
7ff1457987c9931a00dc42699a682aec4891d36d2b2a4c7714c9a7053350589fa28cef87a6c1bfeea6b1d4bfa663022ecd0e26db4c29a74faf0d02d6dcee0286

Download Submit
C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected.zip

Filesize
3KB

MD5
99e3aa578bc9f3223ab17a1ba80c47e8

SHA1
4222f43d6ef90df324b3c3083784fa58d1bb3478

SHA256
b63a44b3a3aaacc67441eefa90c5ce912c80397fc8990bc655f84e86a8cc90f3

SHA512
a7141b3d393943d9312d55e4e6a362372464bf376cf44a7630cb944db7043c085f19b0af11cd032c6863fb9be3bd30df494082b0d87804eae0ceb5a2efad8633

Download Submit
C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected\download_3.jpg

Filesize
3KB

MD5
a308fe528d54a848f9931171fd64037c

SHA1
0438f59ce41cabf44177318b6a43d41d382e9f46

SHA256
a2ec9ac1e519cd23eb0cfd88ad3148dc5a6a70b609002294f5f08c408e3ac43b

SHA512
ec76466e6ffc68289d93ca18079811b8ea3a1157e0b2f2740fc3a289863df06fadafe7811e9898d3a2c6001ff9e8cc0b9ddda6fb902522a6073beb02ea878af4

Download Submit
memory/860-89-0x0000015709170000-0x0000015709180000-memory.dmp

Filesize
64KB

Download
memory/860-98-0x0000015711E30000-0x0000015711E31000-memory.dmp

Filesize
4KB

Download
memory/860-100-0x0000015711E30000-0x0000015711E31000-memory.dmp

Filesize
4KB

Download
memory/860-101-0x0000015711EC0000-0x0000015711EC1000-memory.dmp

Filesize
4KB

Download
memory/860-102-0x0000015711EC0000-0x0000015711EC1000-memory.dmp

Filesize
4KB

Download
memory/860-103-0x0000015711ED0000-0x0000015711ED1000-memory.dmp

Filesize
4KB

Download
memory/860-104-0x0000015711ED0000-0x0000015711ED1000-memory.dmp

Filesize
4KB

Download
memory/860-96-0x0000015711DB0000-0x0000015711DB1000-memory.dmp

Filesize
4KB

Download
memory/860-85-0x0000015709130000-0x0000015709140000-memory.dmp

Filesize
64KB

Download