agenttesla | 1d18101d635590f5e2c403dc2d2b977b9f311a058af0f0346ace52e03328faee

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZwayPriv.exe
Size 6.0MB
Sample240413-egsseseb7x
SHA256 1d18101d635590f5e2c403dc2d2b977b9f311a058af0f0346ace52e03328faee
MD5 2030b451d9ac60a382cc9684506348c0
SHA1 01e26d2a75e04e71f20c7b53eb913624a8d3267b
SHA512 08753cc2c270e06eb9bb4e31a5430359b0f4feb42f010e45af73ba164b374c3ab4469a1692f340787c89814e31ff9b7df0d198692a7b9ea0117f77323ea2ad30
SSDEEP 98304:mVBGZTEVqu2i20qbPnOmdBfsa4HOsbiV4zeMOO36LYQTN4c7PdHtjyXrBtt4ia:I6I32i2PnT14usbiV4vOB5Oc7Le9Mn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla evasion keylogger spyware stealer themida trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/4856-18-0x0000000010000000-0x0000000010214000-memory.dmp	family_agenttesla

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ZwayPriv.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZwayPriv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZwayPriv.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4856-11-0x0000000000400000-0x00000000012A4000-memory.dmp	themida
behavioral1/memory/4856-12-0x0000000000400000-0x00000000012A4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZwayPriv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	discord.com
16	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4856	ZwayPriv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ZwayPriv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ZwayPriv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	ZwayPriv.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4092317236-2027488869-1227795436-1000\{FE8E8031-0AD9-4DA4-9E41-7A254F27A8F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	ZwayPriv.exe
4856	ZwayPriv.exe
1472	msedge.exe
1472	msedge.exe
1500	msedge.exe
1500	msedge.exe
2904	msedge.exe
2904	msedge.exe
1532	identity_helper.exe
1532	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	ZwayPriv.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1472	4856	ZwayPriv.exe	80
PID 4856 wrote to memory of 1472	4856	ZwayPriv.exe	80
PID 1472 wrote to memory of 2568	1472	msedge.exe	81
PID 1472 wrote to memory of 2568	1472	msedge.exe	81
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 3352	1472	msedge.exe	82
PID 1472 wrote to memory of 1500	1472	msedge.exe	83
PID 1472 wrote to memory of 1500	1472	msedge.exe	83
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84
PID 1472 wrote to memory of 3832	1472	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\ZwayPriv.exe
"C:\Users\Admin\AppData\Local\Temp\ZwayPriv.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ware
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffdfd5846f8,0x7ffdfd584708,0x7ffdfd584718
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3308 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4541948436769589015,17651346337420158207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01
MD5 104aab1e178489256a1425b28119ec93
SHA1 0bcf8ad28df672c618cb832ba8de8f85bd858a6c
SHA512 b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3
MD5 846ce533b9e20979bf1857f1afb61925
SHA1 4c6726618d10805940dba5e6cf849448b552bf68
SHA512 8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 fc8f5a5f7f5490758b1258de6a74ab79c7943f22c09cad214d7961407e5c8dbc
MD5 ce6421fce1d178c306aba8c9b213ca33
SHA1 5d4b459337924c0b3132abb284ed695c09502e30
SHA512 de06cfdb7729c1be17a2500d3e054eb1d407286d052faa2c593e0796a4cfb3f6643dd303fc07162aacb1fb76805c40f21e918d6347eec2a5c8833565bbbc876c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 169d449970d94bc58c5fbea02e31c82224ee737d6e67779ef0386d4daed4d69a
MD5 ccfec6493246d122359e0c907cfb03c4
SHA1 27bf925ca7ece51ba417907f21b9ebb4338eaf98
SHA512 3682d08ed6c5639b4689c180093820ca5a66cd1ee3817c5d6ba4bb2d53a264f5ee246a9ba47f18b7858b0aed8632992de129872f36c38ce4fd39feca07d8381b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 686B
SHA256 2f6c6c6f245c98ed4138b2ba88e2da7eca270ea4d833d57d9fa8440e848e501d
MD5 cdd8b9daac611c03eb7a4b635421f627
SHA1 5ccc7fd34a15b99025d335f67e22fd4477675ee5
SHA512 18b1b1a93c7ee89816581bd751f9a11092a4a9bec4e24d1279630adecc8554c295c7d0540c0f5e2b56183e507b0f7bcc01289f971729f58839f9b5bfa200bdcd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c1392a12008338e359a57ca7bf937bb8dc49af50f953e552e98342adf49e7d80
MD5 a82e7108f7f8392dc3924fe65a576f49
SHA1 6bdcdc107b68179b35e552ff3d4babf64a363f43
SHA512 575329567a3b45664138190ef68f60b63a1abd327c451fd2ad709eb620024ee592fb3faeb64f9e01475e6b37d2952fe03835383e8aea78014df34d3e91d81705
SSDEEP 96:n7k2NvQ1DTwpvWMoiVmdeHc3t1UWQyV+VDCziEwb:n7k2pQZTGWMX61ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e5862ae627cca22d4858644b2fcc0d067f137c5eddc21634944b70540bc2564e
MD5 027d9763673715d2ae55fcd030c1bb3c
SHA1 3677a582a1f630a4f7181e0be9f2621ff196353d
SHA512 cb9ad2ae984234101ec4cf8b909b6741d7a138b2b9a9197fc40d38bce82d03ff14bbb1c81047b92647bf79b6659644110d9c5266e3d05f07590eb925ef23ffa8
SSDEEP 96:n7kkBvQ1f/wpvWMoiBR5mdeAw1jNcWweyYQyV+VD7AiEwb:n7kkdQJ/GWMBKw1pAeDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f1da55d97f7f9138e873c410f11a044b635a861d6948154259e234827527bdeb
MD5 0022923d0b8f980483d824c975c11280
SHA1 2ac9a313d53cdf62e277857d58f862fd9077b438
SHA512 d694078c164962a15d81880ec85303ab9381ac43511ff103ad0d84c45e6067a7d9850460d49eb86748f251a93d52a024517ceb984d5d33c711f081e8e3261299
SSDEEP 96:n7k2CBvQ1DTwpvWMoiVmde3uh1jcQt1UWQyV+VD7AiEwb:n7k2CdQZTGWMnuhhh1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 704B
SHA256 cb96e977c0b7398f238486e417e1f8963aef32685b979e70d711d8094d974c46
MD5 35553ea8f02b9021405ecc35793cb12c
SHA1 30f266e22e086ccac194f85a7fbee7762d6441cd
SHA512 541df3e9b10a90e9e060421ad4f51ec97c79c394d55d6ba1ee563dbdd71cc53bd71aa29b57d1fa6eb3b6233280deaedad4d815bae6d88692193483e33b6cf2ef
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58a553.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a553.TMP
Size 370B
SHA256 edab1aeb77e6c5477d17f8be37f4511182a4875d46128d9f05152b975a984a80
MD5 9ef58e8f76b95bdf3c5c1b5eba89077b
SHA1 228e0b9a312d873946490b0e1f92680ccb0b69ab
SHA512 3675ea8de7d9531ce27d49c5c60aed032bf558830f1989b27ae773c78f3b4388908db7ad1ef6d30552a09a2e8ade5bb150826dd28a5408f777bcd5aefe2d5ec8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 801008bc5f10f0f139e1ee7851dfb8ebe913bdf2672cc7966dac41befe75f4ec
MD5 7f9eea4bf57f765b4dc6675a784ea582
SHA1 9102e51fe8f4edf972816b12677545823de6635a
SHA512 ae39caebb8cdc8477891eab8a4cea434f4606f84bd1ebe28690c9cb9e242f5c524fcb8cddfd4eb9df8b5f89767ba0783140792c752391e0dc34806f7b5f24b6d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8Le2RU4JyJoiXs4YwKsgAP:A9iIxuERzA83h09RZxYGiJo4NYwpgAic
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9d2e29f2497bddb29f5dd4efcd7b8d3eddee0e78c515ff86ad4ae2a55fba3978
MD5 b9bee253116121411f281acca0ee606c
SHA1 e10cc6dbb3dd4513ff8636233f3cbe0c376e6c1d
SHA512 18d6eee5f43e9888afa6178c632a4dac329f85472141fd0e9bcbb9615f3e32e2ccdc247ca1a40edfc85fedc43030934124e02bf4458d9ec1245e11455535cc71
SSDEEP 192:XoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8Me2RUgJygoiXs4YwKsgAP:v9iIxuERzA83h09RZxYLQgo4NYwpgAic
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4856-12-0x0000000000400000-0x00000000012A4000-memory.dmp

Download

memory/4856-14-0x00000000057F0000-0x0000000005882000-memory.dmp

Download

memory/4856-20-0x000000000B870000-0x000000000B8AC000-memory.dmp

Download

memory/4856-22-0x0000000000400000-0x00000000012A4000-memory.dmp

Download

memory/4856-23-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-24-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-25-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-27-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-28-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-29-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-30-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-31-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-18-0x0000000010000000-0x0000000010214000-memory.dmp

Download

memory/4856-16-0x0000000005FE0000-0x0000000005FEA000-memory.dmp

Download

memory/4856-15-0x0000000005890000-0x00000000058A2000-memory.dmp

Download

memory/4856-19-0x0000000006040000-0x0000000006050000-memory.dmp

Download

memory/4856-141-0x0000000006040000-0x0000000006050000-memory.dmp

Download

memory/4856-13-0x00000000058C0000-0x0000000005E64000-memory.dmp

Download

memory/4856-0-0x0000000000400000-0x00000000012A4000-memory.dmp

Download

memory/4856-11-0x0000000000400000-0x00000000012A4000-memory.dmp

Download

memory/4856-9-0x0000000077174000-0x0000000077176000-memory.dmp

Download

memory/4856-8-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-7-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-6-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-4-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-5-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-3-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-2-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download

memory/4856-1-0x0000000075FD0000-0x00000000760C0000-memory.dmp

Download