hxxps://bit[.]ly/ccs-wiki

Resubmissions

07/08/2024, 18:50

240807-xg6y6awajb 3

07/08/2024, 18:49

240807-xgj5dsscjm 3

Analysis

max time kernel
65s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/ccs-wiki

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
1128	msedge.exe
1128	msedge.exe
2508	identity_helper.exe
2508	identity_helper.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	taskmgr.exe
Token: SeSystemProfilePrivilege	4856	taskmgr.exe
Token: SeCreateGlobalPrivilege	4856	taskmgr.exe
Token: 33	4856	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4856	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3788	1128	msedge.exe	83
PID 1128 wrote to memory of 3788	1128	msedge.exe	83
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 4928	1128	msedge.exe	85
PID 1128 wrote to memory of 3028	1128	msedge.exe	86
PID 1128 wrote to memory of 3028	1128	msedge.exe	86
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87
PID 1128 wrote to memory of 3624	1128	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/ccs-wiki
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf91c46f8,0x7ffdf91c4708,0x7ffdf91c4718
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3009254615338358288,13327807478572963441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4124

C:\Windows\System32\-ue4vv.exe
"C:\Windows\System32\-ue4vv.exe"
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
1688467c696f5b36dd23a651f364c9e7

SHA1
cc30e1f08e0442c3b43e53bbbfac24b5fbc63c3f

SHA256
95fbd4b903bd120e911dd03dad6971ca1bb0fdb92744f1677514a4c375f86452

SHA512
2e80c5ccf8c724463d7004056f3dd35a99e2ae26e813f864601f0930488f0a7f86943c968ef89b17f2c95b5c8373e5de196f4646ab662e9e82e06de84e6dde4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bde161217d8db74d61bd8eb624c69d0d

SHA1
b3e151a26b801eefa343611fe60d243500902d3e

SHA256
6616b1b4dc88d70139af786646b775378cd639b6441fbb4bb1bea2b9e32917a4

SHA512
1fd45a49cc20114c7256e73afa6d5a49a3293f68a946d3be241bd639809fd2c237f5ee8e4e44d86886b993ec223edf5b7c7063a53e1035ac139fdaf18897435c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c47ddf354081abace39ea44495161c97

SHA1
f6aa68a5f0f520f04d70646a8299039eee70e216

SHA256
81c9b08d35e4f5e1be24ce79ccb68dd3347a7db9469f2cbaeb032468eac9bdee

SHA512
133478f382bce1543c187386a17a984250bfe934f2ddc6e191bf41c968c85c7613fe46232c6cccb759d0f76de971c4d8c578952ede0e6f76ebdc3e0e8c887f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
feceb88ceb4f8607a30119452010be60

SHA1
588ab655654a097b5689ec0c410aa410e55a63a9

SHA256
a548559938099c7f8cfc2c54d61b415dac4006441240a71030ae0fa2f1340dfb

SHA512
781cbcfcf8395c46df257a988d37b764111d845bd27f6ecc1852e9af4ffdd7d4fa87657195a180e4dc0cdf54f299f9d159c4a70cd6a52813ce97c3033bfff2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\a0f8fa72-8ce0-4feb-8b3e-6ed61f708464\0

Filesize
16.2MB

MD5
1a5eaf7ac28f453633689fa2174f8479

SHA1
95bb1a5a5cbcf27814eea7180210357ecbb7ec59

SHA256
4048e709784b2996d6bcc0ce918e7f552de3163fa2c2788979dbafcb4050af7d

SHA512
82724dd4d15ea0997403a8ca9f8de940ea51331f290b917bd9cb6ab7f8026f8c396aa9e290c228d16318d82940b55df18a1d8ba5ca0aaa803260f55b03826d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\a0f8fa72-8ce0-4feb-8b3e-6ed61f708464\1

Filesize
18.9MB

MD5
74e3e347bf7c3acbc4a66c122c483ec2

SHA1
b497b763875cff0532c24cedeeaf4fb8bc0ec515

SHA256
17972f7e1ff191efa1f0a2ea6e7dfa2d6be886867e672914e338d5c1c46fdb5d

SHA512
943ed1ace9c3cbcc022819327723dbee21fcf6a27ff3491bfabc8df349d346c6e79bd9dfdd56f3d1a57e9c553793bd3fb4745de617fa5c4a7b56173cb2a50492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3e2c36cb38b65c48d2b10288eead8af

SHA1
64fe39f0dac1e199ff1c1a44076afa54a6c8776c

SHA256
4850760e8b04c283f5089fd3996086c9e7516a51e34134f01915262078815955

SHA512
64341c6f398ec407f47a34ff5ec18df486dd2471be7a13a276ed8673c043368570297dc15540450c4a1b38100cb7c3f3a086e20aa7919508454b03760552e405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6991d7f7875a846a9b4f8b3449367490

SHA1
63ad1d0447b345e9e48a72ebb49ff2997eebfeee

SHA256
486e0a0f5786ff2e33e46d4779ff5eac7ce9571c484fd8eb27befe58a8d3a93a

SHA512
99ddee581d3c716e86cdc5c8f54319cf339a2103a2e4e345e79883bbd37bcfc48f2d3271c43948bcd0d7ac0036ab8bf7d0e80ed9e269d4de9bfcf4d72eb01343

Download Submit
memory/4856-279-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-290-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-289-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-288-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-287-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-286-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-285-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-284-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-278-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download
memory/4856-280-0x0000025056580000-0x0000025056581000-memory.dmp

Filesize
4KB

Download