d80f9618ef8369e54986f2abf564e5eeccf961d3ddaca515622412b1e4648d4c

Resubmissions

20-04-2024 17:13

240420-vrrwwadh2z 10

12-03-2024 21:36

10-03-2024 04:41

10-03-2024 04:40

10-03-2024 04:38

09-03-2024 07:38

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Reaper/Reaper/Scripts/Aimbot.js
Size

30KB
MD5

3ea5f844c18f550a3db09193c56594e8
SHA1

389968ae4228908180ba68ecfab2ddfabeb0966b
SHA256

d33d3205288b776d977ad0047647bc8d40b83bc7d4f190f86f1011c8b417e983
SHA512

8af81e52e74950a1961ad004400140386b0ad3d49d64e9617ad12d4550a4b1699eddf8e79849a32cdbdad034f25ee535430de9bef0513758e48b29a54d52b440
SSDEEP

768:DW6T+ELiUI29j8vVwP8UkSVDYtDkYNighmLlmyEDKtpWpJ7xwrs5SwG1NBbp0Bwh:iYTEK0y

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1152 msedge.exe
1152 msedge.exe
1888 msedge.exe
1888 msedge.exe
5424 identity_helper.exe
5424 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1888 msedge.exe
1888 msedge.exe
1888 msedge.exe
1888 msedge.exe
1888 msedge.exe
1888 msedge.exe
1888 msedge.exe
1888 msedge.exe
1888 msedge.exe

pid	process
1152	msedge.exe
1152	msedge.exe
1888	msedge.exe
1888	msedge.exe
5424	identity_helper.exe
5424	identity_helper.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1888 wrote to memory of 2740	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 2740	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 4636	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 1152	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 1152	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe
PID 1888 wrote to memory of 3456	1888	msedge.exe	msedge.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\Scripts\Aimbot.js
1⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6c6a46f8,0x7ffa6c6a4708,0x7ffa6c6a4718
2⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
2⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
2⤵
PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17546953109768341899,419625738726439776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
2⤵
PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
3b30ec6a846bda3519f3e9eb9cf4b4bd

SHA1
360ddb4d500af1dc3cb5f2ca10115886403a1b9a

SHA256
6aeda55ebb42f96eed0b9906bee017cccfc95f97f26471dba79aa2bbece8f902

SHA512
c6046c7c5f981886b862cd038fbcaf7538b58ee6c3649f016d953a6ac9c87a3dffafc80dc3a439b543be40c6412874ead8aa6529cc560a7c3b1b237827eb2081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
314B

MD5
6cc599346115d095421f0a8ec1053505

SHA1
ec53f44355eb546d1481655a31662f4f8f874018

SHA256
1ea75a6666722193f3dfe468fdfd8286f04664e7fac3ff84e465650cb403787a

SHA512
5919eca214265de85c85afe3e6caac4a722ccf045b6a917fc8854f88d2c3cabd48f37237f4d45b812d8e9d377c9af9c8ee9e5a818f0317b802b928a1eb601bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c56424a4faf2c0d38bb4f913e5c2c0b3

SHA1
eda24cf1193ff4cee3ae8a46984e4d070ce1d966

SHA256
d3d97b0f283d56359b8e148118e68ed015645976d986de95e13e80bbd6445910

SHA512
d4c9f6971b99915fb4805095d9e42163237622c2ec00eae775a34e7d510321b3254335abb8b8ae26ca775c7ce1e1e912640f60a5bf7bc067d90dffafa96abe57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f3daf2aee6a1f6200e56fb9bfcbc166c

SHA1
79bd5d330206e4e82b51f0f83c9e81889d43588e

SHA256
ae94181fbd8861edc89af7790b7897243603deed7946e77b1db33aefa3fd21d1

SHA512
80f9c770d7bdfb40a8a82dcd969ba65ba2789ca9cd6e0e20e55faf20a7de9076e0512b1eef0b66ea0284d9806754d71d4d59664c13f614607d6a6287e7ca4bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
138fe848c99c4ee6b7ee829b65f02fd1

SHA1
651552c30315cba24329a13d9869890da0d312ab

SHA256
8e93f199b95b3da4a4c0b5dd9a5c80db7eba7721b638c7fb929bfc2736803daf

SHA512
fe77877aaf9026d4d5ac2435a380936d818d65395dcfe2dbead76022527d1ccaa2fc0671369280977bd2d66b76f63eeb765c4817a70f1fd6173302d82b42a871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4174136160e456e51da2c8e38e51968b

SHA1
d70f61131aff3d9ae60c4950165a0d6b7140ea82

SHA256
a57e2e0aded726bbef489ce22b0d518681e9dab00f41c9ead7243dfdcc8f3178

SHA512
dda5332349ccb20ddabc79d7a28e802a075f62788e93ca1a155e3d66c4f5ec205acc602c55651ff8def483ebc2830e96819d03ae6d2f9eff2c3511830bd5faba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bad4d55f832bdc2e619d6d8fe6d19d6b

SHA1
65521f4431e95846519c8133bfaa0ed1a9086005

SHA256
93924021e21eab2679156631d460a86c32704365a89136e4b2992a12fc9eaf7a

SHA512
0a907f047979a370a46d76d98636956fe230dafb8403a4bcaccc175f37b8553a2cdb51dd9691394e709b224ae320c0467038ba17cfa325da0efeccea0d242948

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_1888_GNVQNKGTOOGRFZRH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit