Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.ecobill.net/ticketing/api/attchs/v1/mail/Bearer eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIyODc0NjgzIiwiaWF0IjoxNzE1OTQxMDg3LCJzdWIiOiJhdHQiLCJpc3MiOiJIb3RlbGJlZHMiLCJtYXAiOnsibWVzc2FnZUlkIjo4MDkxMzIxLCJib0lkIjoyODc0NjgzLCJmaWxlbmFtZSI6ImF0dGFjaG1lbnRzX21zZ184MDkxMzIxLnppcCJ9fQ.si--RVeeI0ZlJQz5rWJ7GOklL_7-nAa4fpn30af6y_4/
Resource
win10v2004-20240426-en
General
-
Target
https://www.ecobill.net/ticketing/api/attchs/v1/mail/Bearer eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIyODc0NjgzIiwiaWF0IjoxNzE1OTQxMDg3LCJzdWIiOiJhdHQiLCJpc3MiOiJIb3RlbGJlZHMiLCJtYXAiOnsibWVzc2FnZUlkIjo4MDkxMzIxLCJib0lkIjoyODc0NjgzLCJmaWxlbmFtZSI6ImF0dGFjaG1lbnRzX21zZ184MDkxMzIxLnppcCJ9fQ.si--RVeeI0ZlJQz5rWJ7GOklL_7-nAa4fpn30af6y_4/
Malware Config
Signatures
-
Drops file in System32 directory 11 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
Processes:
msedge.exemspaint.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings mspaint.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemspaint.exemsedge.exepid process 2920 msedge.exe 2920 msedge.exe 4584 msedge.exe 4584 msedge.exe 2608 identity_helper.exe 2608 identity_helper.exe 3004 msedge.exe 3004 msedge.exe 5368 mspaint.exe 5368 mspaint.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
msedge.exepid process 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe 4584 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mspaint.exeOpenWith.exepid process 5368 mspaint.exe 5552 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4584 wrote to memory of 2432 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 2432 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 5080 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 2920 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 2920 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 3260 4584 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ecobill.net/ticketing/api/attchs/v1/mail/Bearer eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIyODc0NjgzIiwiaWF0IjoxNzE1OTQxMDg3LCJzdWIiOiJhdHQiLCJpc3MiOiJIb3RlbGJlZHMiLCJtYXAiOnsibWVzc2FnZUlkIjo4MDkxMzIxLCJib0lkIjoyODc0NjgzLCJmaWxlbmFtZSI6ImF0dGFjaG1lbnRzX21zZ184MDkxMzIxLnppcCJ9fQ.si--RVeeI0ZlJQz5rWJ7GOklL_7-nAa4fpn30af6y_4/1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e90546f8,0x7ff9e9054708,0x7ff9e90547182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3428 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,3616018687965215131,190319001446042269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_attachments_msg_8091321.zip\Captura3template.PNG" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
183B
MD573ec25c0df5312dbae8ae0046285264e
SHA1cddc0bebcff399fe4c850513e933e63487596dbb
SHA25611480b57c6008f31bb4b69faf15a0fbdeea24c5a6d79b9f951b110b58b794cfb
SHA512502481b7fa41d92adba3016003482c284076110a81dcb9f1b849a3720ac0f86d2d2546645711668afd4eb4f5dd867d27be3effd11a76fb40ea4535b6b1f0e39e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD542b4e5b2b35652f82858f32fcb04edbd
SHA1c81777c68cfb31c7f30174e195f0b7716dc7172b
SHA256f01c929023d0a19bac77097a6fb26a53fb89f28d98e311e74eaa1f631070ca94
SHA51202afd80fdf0e683f7aacdf56f14621c3f7ed5d0e7c1d1007783d8a657c109cd1e19d3cd4f4fd9c24291dc564647af343eeb5d65fd4ab920f9eba5286beb8a813
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f4bd614326f56b77d24d45e5694cb580
SHA1b517badf683778735d7c062f1d6df7398615d7b7
SHA256e41955442f4c964c1ae5a999d5e6bd6242b6506e24e23b2034a46934a65a0bfc
SHA512af3d626e32a1602a465996b04eab0b9af22a90cc8df8ec690ff5be722692d987e424a63117c6e2b631be4903db54d3f7d5627a1f977389f61ea950b26a1c422f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5b789e0ce83d0875536d53ddd6c6a3fc9
SHA11f35f76d07f93c93539f8478b84758e49a29f146
SHA256bd04fe250440fe744dcd495bae515b0275d869608dfbf5b19ad7e724e27350b2
SHA51231dded2e118f4f018eb5e60dce75f9e06a9f5df4dd36d612f7ca996171d99b7d4500fdb7ca0f6cd61350fea1f061f6c24f94bd0a5b30a75d34af2c78832f7997
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5fcc5fac19f0510b5a13d7138d1846447
SHA116b488c4194da90300bb630bce7138110d1d3d2a
SHA2569c5909b8d98003937842a61269ab8dd8de2142760ddd43483bbd2741e354befe
SHA51298452a638b6214f8c81b92c376c5b3e96373a4e7e61987a71bd98332ecf21035b2f0b08e75dc335cfe3dc29ecca4f972bee45e42202b7ed5735509fe0fe70c2d
-
C:\Users\Admin\Downloads\attachments_msg_8091321.zipFilesize
332KB
MD5c67c3c4775dfd6f43f4f815c84a43b37
SHA18f227443b2d846d9893bfe4a02dca31fce1915d1
SHA2561569f7f318c0ebb5ed7a8d4778041f18b3809c893ade4943d3e97d711055bca6
SHA512ff76dc647c3e1bba69a288800e5f8b7296f18841f578e034844e4c7e904ccd0d5f7117ce717d4342ff54c3083c6802e0213fda74275474a1a13e4207a4aa8d91
-
\??\pipe\LOCAL\crashpad_4584_CYRQBBDOYZVGUNXLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/5412-71-0x000001BC85B90000-0x000001BC85BA0000-memory.dmpFilesize
64KB
-
memory/5412-84-0x000001BC8E7A0000-0x000001BC8E7A1000-memory.dmpFilesize
4KB
-
memory/5412-86-0x000001BC8E7A0000-0x000001BC8E7A1000-memory.dmpFilesize
4KB
-
memory/5412-87-0x000001BC8E830000-0x000001BC8E831000-memory.dmpFilesize
4KB
-
memory/5412-88-0x000001BC8E830000-0x000001BC8E831000-memory.dmpFilesize
4KB
-
memory/5412-89-0x000001BC8E840000-0x000001BC8E841000-memory.dmpFilesize
4KB
-
memory/5412-90-0x000001BC8E840000-0x000001BC8E841000-memory.dmpFilesize
4KB
-
memory/5412-82-0x000001BC8E720000-0x000001BC8E721000-memory.dmpFilesize
4KB
-
memory/5412-75-0x000001BC86460000-0x000001BC86470000-memory.dmpFilesize
64KB