5a32b1864bcb2d237aca956c3b7474c2de484c38cbaa608ab5ffc71214bae2b8

Resubmissions

07/06/2024, 15:13

240607-slps8aac5v10

07/06/2024, 15:11

240607-sk3zfsbb9910

07/06/2024, 15:08

240607-sh7vmaac2s10

07/06/2024, 15:05

240607-sgnqcsbb6510

Analysis

max time kernel
488s
max time network
496s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZeusHex-GUI.exe
Size 1.3MB
Sample240607-slps8aac5v
SHA256 7d32d13d123871650794a1e172adc70bc8dafbdb762f49d889f813844d532b20
MD5 ad714ee48d2e829c5012c65de6166c05
SHA1 5880bac89ca346dae62c053aa49c028372388edd
SHA512 a51252950455dbfb5dfd564689e605b022bdf26f80ad12f3fde3e341a14b8f764324ff3be6f29e4855bd499141e23628e9aabb0e439627dc802814db091d54ee
SSDEEP 24576:ZfaPwrgBrO1BKH8jPcWYVxHCoh0XeV61r9qZWe7d7NWS91GsVz9cebgS9aI:ZCPwrgBWBKH8jkDVFCNXODzWS9HfX0HI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2994005945-4089876968-1367784197-1000\{3C482259-4D6B-4796-81DB-D719AEDB4418}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
4624	msedge.exe
4624	msedge.exe
2864	msedge.exe
2864	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
3012	msedge.exe
3012	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4224	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1580	4624	msedge.exe	82
PID 4624 wrote to memory of 1580	4624	msedge.exe	82
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 4828	4624	msedge.exe	83
PID 4624 wrote to memory of 5036	4624	msedge.exe	84
PID 4624 wrote to memory of 5036	4624	msedge.exe	84
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85
PID 4624 wrote to memory of 1048	4624	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\ZeusHex-GUI.exe
"C:\Users\Admin\AppData\Local\Temp\ZeusHex-GUI.exe"
1⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff85ebb3cb8,0x7ff85ebb3cc8,0x7ff85ebb3cd8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,14954376452797460994,10224123187524504461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004BC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9816e980b04f1fe7efaa4b9c83ff6a0fdd485ee65a884c001b43a0cad7c39d83
MD5 5e027def9b55f3d49cde9fb82beba238
SHA1 64baabd8454c210162cbc3a90d6a2daaf87d856a
SHA512 a315e1336c5ec70cbb002969e539068ba92f3ec681b6d863db95227fd1808a778fd994e2fb03f28f0e401677aa5f7c66813e315b6b99a5065384c49586f9782e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b8b1cb139d4d19a85adce0152fa3c4f6adfb73a322d7253820e848c6f82afc1b
MD5 0c5042350ee7871ccbfdc856bde96f3f
SHA1 90222f176bc96ec17d1bdad2d31bc994c000900c
SHA512 2efdb535fa6a06c4f9702b2129f2dd07c330e37fd10b492f2236007c660c1707773c22005d1e1fa580dbf633dc1a700ada3b7b611ef9accd9555a17a244f61ce
MD5 SHA1 SHA512

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Size 94KB
SHA256 b1632acb379e521195a80016d98523d0b4a284408950700f7fa13c946514a8d6
MD5 32795c773b90c62e15ef1cdb8641cac5
SHA1 9c64883e55d227a814e8f4de1f5eac2b1564bd6f
SHA512 c9832198bd8db9d5477e1adc773dba6b09dd882b9a5ed52210d785bc4383153970316fdee0c0956442ab95a99591a3d1d1dca395bc83bf5b5a304c11b7af6365
SSDEEP 1536:u5aWsZImpNPKTkG9vM+hFtTMI+9SjqPyztNcWx8RTJl+Su1DpWku4cQp:PdOK6M+TF+jyzvcq8RHSppaJQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022
Size 73KB
SHA256 688f7b7909a2d1963c650e8f943362a227d9bb0b0ecb9649a28dec68e2da74ae
MD5 a1271334f755e4e243a5e53a069805b3
SHA1 d43a327cc838ce117f61c2de1bece6aaffe37630
SHA512 3d939121fb1750545715c991348b871a0a76346362ecb1f9b917abeff05b9d934e501ef40ac28635982a8b6a81f662e40f67152a5829b8fc1943e362ac93cd76
SSDEEP 1536:2mn8XmM4N+3+Oj+0GBWGGW75GXPFozxrNXoD4TeA:2mnTO+8+0qj75GXPmxrNosx
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ae07459fdae80d54d581c5c130b416f4e86bf987a38ececc598c47251ff5718
MD5 56d41891587ef542e5fea9d822f3bb73
SHA1 ad24cfe4167e1e29c7b6bd612126f21108ce9e77
SHA512 b3b0a0cf51d426ce31f99e8a8e652e29e647c2a63058945ab885cb3eb9f96e293bc95cbe5147cb283a5258dda2eef7a98f7f335a2aeece221191de73b6037bb7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9ad88bb43eb1c77d2774f51698d6a6198d51540e7bc8acbc361c67d489378cd7
MD5 5eab2189f5992cd83f984099a4e48146
SHA1 4297cce033252dc2afd8edbb45bb7f72d27c85f1
SHA512 733586204d22942eb0c75d2b398159557c6bb217ec037d0232b6a309ae93cb529b1c498f44b34a0314cf75fda449859fbdfbe6bfd1b5bf742c5f085399b77fc8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 c580e3e0269059a399143d57cfe961179c7e4861b253b39543283091586c4caf
MD5 890b559bb6fa3f3d79036850e0d498ce
SHA1 b2fb73cd48966e050b368297f46c3438e8e8938c
SHA512 995fae8b3a0a5e00d9f261f155947557afc0d930c18c83969d4ab7eaaada8a4754c6fff2a35ef7b27bc83f7d47e1ab6e46e76d1d5d49e6f42b300fb868a2554d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b9e0cf5d2ffa7be47a1210e64848e1cafc32547eea774ad3ef0e1f5f613d501a
MD5 017aa56ab0306292d5f2250f39370cd2
SHA1 30a689fa3dfc0f0c7dcab3b7bb6c1df9cf9c5bd0
SHA512 79f4fa98d753fa67426689f83f6e512308089398deb7032dcb271053ca15027e05f5a6568479d2cbff0dc4b0a64224b5586e89efa6d356d7f4f433cc77f476d1
SSDEEP 96:nuk3lLQsk+kwSHp0MoiVmd6uw1jIGJCW0WQyV+VpAiX3wI3:nuk3xQsk+kHp0MruwhI0CWLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 68629a6acac7a4ffd7403d50be5204f6390f8f19cff7eaadab9d1f1c8b90a844
MD5 d365185798ef23c21abc7146e0a92b32
SHA1 971dc41511d68bce53d6aee7ae386e79a83589a8
SHA512 4b850ffe9c29c363590875ce49cc94f3d568ff1c41ff8fa4d7a9fb1ca629683ed4871df9060281104c201123ebc7fd584cb634bb2e7f68f024b0b4d12dab0ca6
SSDEEP 96:nuk3RLQskukwSv0MoiVmdHIjJCW0WQyV+VpziX3wI3:nuk39Qskukv0MAItCWLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3a8a47f5f6ce1a44b1ebb07e2197406a760babc9c417231c8912ccc4166b0a5f
MD5 42128389e947d5001ce17bcbb65f9300
SHA1 ce1fb18a7d94a902ffda8644f0481a0fcd42e7c2
SHA512 7891a3f8c8896df346b60cc56e4493090a0f6fc7ae232c739915a7f8afde292a168102851da31341f2e5736abfd803a4f5df9f9f8f749d8724a8c28307118f01
SSDEEP 96:nuk3tLQskTkwSbD0MoiVmdgG+hAjEV9x2fueoJCW0WQyV+VpAiX3wI3:nuk3ZQskTkbD0M9G+uEV9x2GeuCWLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\38c8892a84268700c1d555293fc3fa782ea43951\f44cca85-34d5-49d4-a71e-3831c3936f4a\index-dir\the-real-index
Size 72B
SHA256 c59b932dcf27f2a82ba7e5c6e9f076d3e60b5f4bcb9cfc3c028b3a2156a7c250
MD5 1b260f261b83211d35056b921af39a12
SHA1 182ba234ba1c3a0e09826d9b3e1a26c79f6c2806
SHA512 25a592eb97259baf9d07dfdcb7771c9a6d9a15559197d1083470e1f0316f9a1c7f79e554a1af084b923c401cf5fe472954784720733caa0eeafb260321b86811
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5e41f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\38c8892a84268700c1d555293fc3fa782ea43951\f44cca85-34d5-49d4-a71e-3831c3936f4a\index-dir\the-real-index~RFe5e41f8.TMP
Size 48B
SHA256 a745fc298316f8c84c528fb4587324c4a8d68531d04a63cb0bcbac432b4e8b78
MD5 d8fcbb3299fc1fb3ebc2473c37c7fffa
SHA1 ebcb366ac94d769c98918a8ea98165328a918fae
SHA512 4d477685ff8d046499ff3fc3f0c036b4b821a94356bdffa7860cb226ecb5783aa2b2b2bf89b287b8a92f95e590233849eaa547eaf4918ec379206f27613fec01
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\38c8892a84268700c1d555293fc3fa782ea43951\index.txt
Size 117B
SHA256 be5c32170bfe68e1d5adb689f60fcf8628dc08e78279c667520e1bac36bc4782
MD5 8bd60f5fce3ec2b5424787957a4b737d
SHA1 fe66eb1102bb29a70690cd9eb3c7745a2861963c
SHA512 165ca70b521d93fd9adf055e99801d33a9038bf46692ce2243b30cde0b4de38fac0e2c2114171bf008e683b83332cb9e09a838b619a2627990eaa50bc738e518
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\38c8892a84268700c1d555293fc3fa782ea43951\index.txt
Size 111B
SHA256 1771ef7bd994bedcd9742ad8b6289c7380efba3942a69836622cb4248f16df3e
MD5 6b3b15f4245b5db630d3cdbc15ad39a5
SHA1 caec540f67a307645d0d7bf616f7de9ef2e98d7a
SHA512 c85121869946838fd281a9745e19f12a7dd4ef258ba2c452e822b1da5c8d611fcc4927ca2de2f5a275d8896da9e8f15f453b9ad7a97d7c9a10c2611c8c190475
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 08ad4052f58d3228ac16ed86892ff9d11947e63b7a14360b92e02024b4e5e557
MD5 6d65185c25f2855ed9a09af646eed9a7
SHA1 cd036d18f4fcbbdf6a79fb0cb1d448a138037f9b
SHA512 75cf47a2708a1046e0758511ae8d7f151df2849e075ecdedeafc8427aec43d18b67a1e93ddcca43cefcbb30fec941b77a2067d3adbe8999bbc90e6aa391c9010
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5e412d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e412d.TMP
Size 48B
SHA256 4eebcd0c410f58cc0db6f3119ed30b2744e85d2f39acef898c171a6530c5899c
MD5 c4c817eea7a3a93647bed977c7ba075d
SHA1 33effb4cbd71c5435ad7a4cd426fb374dd9583ea
SHA512 7295899b4d72ff262a3e3ae47dd65f79b3ba0646bf44b9718105cd88eb216f4df87d1db1b3fee3128edfab4a6bc1ab4ceb833a466ef5c19a99b3b53a6fc25068
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b57c8cba23b5a53a940d7058f108e27a19f7734e583cad06ed04f42d6ce7e92e
MD5 e9894f2aa49db11cd5c4248fe6263852
SHA1 afbb43afb0b9f0abfd00b6d3ddc292338db94f7b
SHA512 77f2de7e6117b61dd631205613591354e90dc407ef87d172041672a045338a1a406153101a2cfad7c92471e8229f7d4cfef7268f6023c5d0a25f54d37d533d7a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5e14fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e14fd.TMP
Size 538B
SHA256 6196a84bfc1db7b69236af91c47d1f99fe1534a7da08d88f527f51daa5c0e5c2
MD5 fccbf17752f3be8e1ea9763049a2fe4a
SHA1 8e0800db85e30f0fa6d36d8ea62904f8c1e12bed
SHA512 8b769e6d22a06d37c70c58c8bedb179198bb22584c91f37aa70b736e1a1d557f77a05c0a88edc177021542922325b666a26d6c4325ea24880059a89374a7e1d3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cb8d2e4f8141b9d6abe45f170946f410de05d1cafe7ed5ca0b1c4b160a77c76d
MD5 d69f959a6a95147507e8aa1130631fa4
SHA1 54eb563850e285fb0a53ed0ae5fa95b13d23c114
SHA512 3440c1d3ebdf23b1fbad7073d91a708c34978f388c0b986b33b01434f2c354810f01362bfb9a2e85d82f958f4b70c3ca22c75aec0983a1440526a39383fbbc46
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGwgVQe2RUYkRPU+17YvmljEWP:M9iIxuERzA83h09RZxASG1ghb+17Yk9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3352-1-0x00000198594D0000-0x000001985962E000-memory.dmp

Download

memory/3352-0-0x00007FF84CE13000-0x00007FF84CE15000-memory.dmp

Download