dcfd8b076cd8aab64b9f4f2c7f9bfe992450e24a911d45ad401aff2d5cefc160

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-09-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wonder/1 Hit 1 Wonder.exe
Size

4.4MB
MD5

58c67359e3797af9d89a2c1c1bde18b6
SHA1

f40af9d4ce76a32696ecc8ca116e489a1a98eb77
SHA256

ad4ff52deda88e74e641ea9d12dd04425624ad9c279a60c197ff52b9cd2cacea
SHA512

5eda519e5315ca85162cf2de7c6bea4f5576d168cac120872694e4a14ee18857e44c43d833d1c5945ac35b29775a66ad121bf81980976d7bf789ad757fb129a2
SSDEEP

98304:BBrgXLdpvOL+UnL1OLkcCeVULwsSqoOQHNUGC:BB0XTGqEogcCzCNR

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
15	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3007475212-2160282277-2943627620-1000\{D69DB888-8F51-4617-AE38-C22BFEE9D6F7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
1940	msedge.exe
1940	msedge.exe
4756	msedge.exe
4756	msedge.exe
3652	msedge.exe
3652	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 1940	3460	1 Hit 1 Wonder.exe	78
PID 3460 wrote to memory of 1940	3460	1 Hit 1 Wonder.exe	78
PID 1940 wrote to memory of 1208	1940	msedge.exe	79
PID 1940 wrote to memory of 1208	1940	msedge.exe	79
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 3536	1940	msedge.exe	80
PID 1940 wrote to memory of 2656	1940	msedge.exe	81
PID 1940 wrote to memory of 2656	1940	msedge.exe	81
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82
PID 1940 wrote to memory of 1588	1940	msedge.exe	82

C:\Users\Admin\AppData\Local\Temp\Wonder\1 Hit 1 Wonder.exe
"C:\Users\Admin\AppData\Local\Temp\Wonder\1 Hit 1 Wonder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gtayes.github.io/Wonder/discord.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb0c3c3cb8,0x7ffb0c3c3cc8,0x7ffb0c3c3cd8
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3444 /prefetch:8
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,958429013999769365,17611968169330240459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5988 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
126KB

MD5
e173b0b5281ee4cd133a0cb4791ff71f

SHA1
7d18b0718f99ab35a74c075da1337917784c017d

SHA256
bc758b7ad0d28f54da5dd5689fb798279d6367ee93b1092d0f74d12cb5b53c7a

SHA512
48313d2f06eee14fc77c69f750e3a637e8b53e1ef9b033ed65f220e9e19a396e649314da0af8b13b08de42a30cb1d1441cad70bb1a59e27f953a65afa4e08707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
79251c2138905cd61d30e9cf8b674d8a

SHA1
cda5c3e98567ad5bfb4549d459ed4fb381e382d1

SHA256
9e4d64e3201b69e5785dedf8f343b995e2accabe60a8c5ed6ea82aecb69abcbc

SHA512
a7686966e0f44ed866a627ffadbaef7a92d1da649d4c4ded1ff481f04de9cfd8d5ca64b5011ee6ff0fa8a244b24b0c01bdc7a0c83d7ebe905914dd673a7da547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
610B

MD5
be2fddd6f8fcd7290a592ee3116aff45

SHA1
a24ec22926972ade44274f2c0e8f60715adf3f17

SHA256
dcf255950057bb60da01b2a436469df07520abd86b6f58d546b1e0e5803439b9

SHA512
dfc0bfa83f4508356b86bafc4552ac6ef6cdbe54db3172246720ae53debfd447d9d6b1704ee8080895290743b2155879120042b7291595b978dd183323cebb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffbd9be1dfc5234dd699b7fb8eda2fb5

SHA1
6252613056ce10a2124cc087f978bb2898589f95

SHA256
f5a0ce4375151652c8693d4370e50972230a739cb764300549a6ed840edfe975

SHA512
27d489ea745b89362c9c7e9f6e45d6cfb6e725c8cb507b56e15fd9d47c83f8ea067805b4f28f94db0adfd67916fb278d4e0f38ded243b3be527c8b3beffa3393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c18daac26357ff0bde520777b8da0c21

SHA1
b5153caa65ec03d81d22bafa515bb2c34a0d556f

SHA256
dae39366cb170d25978a0933a5d9b2376973f2a29a139139a921787498c28022

SHA512
6a2c9b72489ab41f4b31fd2f3bd2eebadaebf6e6e770a257d89d2b29fd9aba371b60c45c8709dbdf4a65d9ea845d5e881d6e06e4fb465823edc016d61181adb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e41342fa707903b1df1ff5dfa1a358ea

SHA1
e10d251c394537e1b0e9eb88182c7a7b5420c371

SHA256
a591ea3eafcf734513d98f599b8aec6a2b3336c9410b7358057b0abf2cdb3d3b

SHA512
22f21122a2d764d2a65eda0ff4411138c726424e2d12c5d31ec4e4bed901666b68af1cd3b4c7fa24dda29b01309cd71edfe2f4c62c8ac9b32dd50baa40f443c3

Download Submit
memory/3460-5-0x00007FFAFA830000-0x00007FFAFB2F2000-memory.dmp

Filesize
10.8MB

Download
memory/3460-138-0x00007FFAFA830000-0x00007FFAFB2F2000-memory.dmp

Filesize
10.8MB

Download
memory/3460-137-0x00007FFAFA833000-0x00007FFAFA835000-memory.dmp

Filesize
8KB

Download
memory/3460-0-0x00007FFAFA833000-0x00007FFAFA835000-memory.dmp

Filesize
8KB

Download
memory/3460-159-0x00007FFAFA830000-0x00007FFAFB2F2000-memory.dmp

Filesize
10.8MB

Download
memory/3460-4-0x00007FFAFA830000-0x00007FFAFB2F2000-memory.dmp

Filesize
10.8MB

Download
memory/3460-3-0x00007FFAFA830000-0x00007FFAFB2F2000-memory.dmp

Filesize
10.8MB

Download
memory/3460-2-0x000001CB717C0000-0x000001CB71802000-memory.dmp

Filesize
264KB

Download
memory/3460-1-0x000001CB56EB0000-0x000001CB5731C000-memory.dmp

Filesize
4.4MB

Download