hxxps://github[.]com/face-hh/0xbj

Analysis

max time kernel
779s
max time network
968s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/face-hh/0xbj

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
3464	msedge.exe
3464	msedge.exe
4508	identity_helper.exe
4508	identity_helper.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2664	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2664	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3036	GTA6.exe
3036	GTA6.exe
3036	GTA6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1912	3464	msedge.exe	84
PID 3464 wrote to memory of 1912	3464	msedge.exe	84
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 1248	3464	msedge.exe	85
PID 3464 wrote to memory of 404	3464	msedge.exe	86
PID 3464 wrote to memory of 404	3464	msedge.exe	86
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87
PID 3464 wrote to memory of 4736	3464	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/face-hh/0xbj
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba7e146f8,0x7ffba7e14708,0x7ffba7e14718
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6584 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11863058935525327727,9590340071085736900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3960

C:\Users\Admin\Downloads\0xbj\GTA6.exe
"C:\Users\Admin\Downloads\0xbj\GTA6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3036
- C:\Windows\SYSTEM32\CMD.exe
  CMD.exe /C "cd "C:/Users/Admin/Downloads/0xbj/Virus/main.dist" && main.exe verify"
  2⤵
  PID:4464
- - C:\Users\Admin\Downloads\0xbj\Virus\main.dist\main.exe
    main.exe verify
    3⤵
    PID:4480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x4ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2d20ba00a0d4c493ce3221d467d78527

SHA1
fd479092a62d8954f130c17ec1e4533cfd076f6e

SHA256
0fd14dbf7336e2aa9fcd42bd7f03d35246a900ea79ed890c11ec022cccf57cb4

SHA512
e15ef6a580274df5695e361eb6c0d1b70b560b8920e672067c59de7e22076b87f864f2349e5d1dc15093ca6f9d64132b1fcfe3654f81995b845250657388f6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
5310e8846dc781ad04a2351a3eca2349

SHA1
bbd5241e71204d61779e7a1ffb9d56731cb26fd2

SHA256
ca68404dfe5ce2ee0bf88e6e3b6d0b1d7042dd4c453fe0464f8ef99a63c949a0

SHA512
0e5fb6dd45c7399cb2eced949a16099ad316e5b4bfd81640228362745392f0993ae855745912f1aacb7c837bb1826137c058764f3bc0891462503b758bb54619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d591fa6ab711adf706e98a11a63ced54

SHA1
2914824b7b43cb47e050fee26a7b9ff6ea2f1c3e

SHA256
06461c7002914d12893437adaf7937c5d5f017383ac2b8ba2239cb9569d25ad3

SHA512
24b67bc28e692681e52bf5b018e4522d5e85cb0b76ef3ad78542f339f6ffb37c1c11fb1284ef080c03021a646593c0991bbd25f427d8259492fafa3e24ec4366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3da890cbf631ab4848710e8931c8c7b0

SHA1
8fe9d53afe61730c66698710bf0aee693bc9ab35

SHA256
846ee1762e7430e097fdaa00406686028cee46d2bdfd8682a172e8a9f577d48f

SHA512
ada80fa3929ad4c17fd9ce49fb21873c73eb685b8e01514dd01d6a6ad5dbf02a434222caf4eaf5f6be039bd3a3d907d35cc27b2adac15bdea9dcb3133fccd3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e09b6cfec22ab0ccdd48b257d00b575f

SHA1
cddee0cf4569dea4fa8143ddfdb831ff6abed0b7

SHA256
23421339bc4d4ae4023e8e6e96deead6ba81cbd0d07911cfe0e0fde2612560bf

SHA512
aa010fcea8120d980943c65873dfebeaec642ed3cdf9633e76b3c3ef0236a3d0d5f1574bc928631099292c2c7120448c57a09ee65c810318db2e88efd4106835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5a03f20c9d51dbc565f6b8261b4f3cd

SHA1
0ba1ea22db9260653c77776821b926db871b9e97

SHA256
cca856a9d8b25245841785a4a2134b9f0f040208c02323daabb9a25cc4c2a9f4

SHA512
73799c4cfa760f4a37be5561101f0df83c117a164b03ba6b838fb0710796c4f145ef9ccc5565f395bec2c502f67a3d7755526a97b13fff14fd8888979eb8bb6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43d820b6ba4051eb3064e3f6f2835752

SHA1
fe38e52b8c9bbbfd98e660572a90082e341a907e

SHA256
9c8102419a53813766c5092f205167e387b34dabce55c375a33ca2621f2bbb07

SHA512
4bb0cd2d8ed0ae8948410ed117f729b523bb192e1f255fb3f0bb54d054122dd8782df20decc8fa4ac6862e2fd16e1de7d2a6448b40d6bb962571b0693e01fc88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
861f4c6943c0d6ffd382113a05eecf77

SHA1
ce2092a43d6113cd2c21a73ed28870bd197cca58

SHA256
ba0c615828d0c49e520d0e504d6282e3799c03cc0032b06c9616b233375b09e4

SHA512
201c41af14110aec6776968e21c6decf6c82d695a6bf9754cbc3f880d85ed99dde7040986e58eb416705ff15f3874a61d5dd31a0945c2700b4986a349be03bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06895194687056a017162017c6c5fd19

SHA1
16c3b678d891eba11f9c8ac976f446a6b330a6bc

SHA256
14ba9baf426f0d22b5ca19014873c431df143e232ee638a2124c0d9c8656eb14

SHA512
b540c3ca798bb83b9f9264a839b59140d5dbb175f2e22e070c5299218925d2db72fd82d2709d98a71c26c9a19b24e0048b64119178c84be00c10fe693ec46189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bab701441692e4a1d60b84054f137be9

SHA1
21a9093531fa73abd6ced57902b5c070e8e15c10

SHA256
c03d2bf16218841d522b0ad147d4004d469af3752f0c61cefe3f1eaf9496564d

SHA512
20521f07165376af18a4a37461a01e646d973102805111f6c3903953a41cd0645b1c5ba4d76378a9c0aa6739651f8d0eb5bce24128ed19ba3923e6b1f69b7ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8b1.TMP

Filesize
1KB

MD5
3d5ee95f05bad10dbf0f7badedf6f196

SHA1
13075735aa7237a7d18592073f026c5421bc22a6

SHA256
d174aaaddaa9df13ec2a3e2620fda5dbe151caa86af434ec8e05aa1c17fea22a

SHA512
fcb204e012c301f2a7aee7efc1726c8d632882fe1bed22da121171cd272fb6852fd7e8969a6646e1fb664fd0cfd38c044c6086c4af8842a302490cfacf60757c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bd511a127794390b97236d6d115071aa

SHA1
d537e1e1064d937057c7ff0e665f13c01453d2b0

SHA256
3520aaaff77e0b7ebb4fb5a59ea7b4da17689a4c44bc09099547e6ec381fa3ed

SHA512
c222afa973d515e66effc8fec24375f4d4de14d4bed5d5a508ba15d189b9edfbbfabdf9e7924cd1c04148ab984ed55a729f0b6486c10293116a4a6171cdf98c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3493e6386c5aff0cb5e980c9b9422fcd

SHA1
3242a870588319baf380bce44318b25647bb4fe9

SHA256
6ccb867f83f29868f65563cae3c6783395f65b49f165bcc018cde4b4654d31b4

SHA512
c62e1029aef95f185da073c6fb6373e0441e4350737c524cc434722bfb5fef55294d009bdf1f020d6364be46bef068390af209a295388c1e668f91a505b0583d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
19f7987a03b747ec04e7fdb8c6d7ba56

SHA1
7b7576cd211736dc624e26a25329013d040c0040

SHA256
487821da6459a2cb032b2567328e4695dbc1ac6af314b5aa0d4a32522c37f21f

SHA512
b275afe7700277d0670e5f3f2548d7eb7d47872d161a4d2c6e2b8b591b2a3e88c2d0c46a2d3d102f8f70aad92bfddc96e3a689913d1ac94a923027c3a258aeea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a34e82b9d1692b694990b2eee75e535c

SHA1
0526e01a3a3ed2550d33550a99d658502832ae47

SHA256
828aafde19a9065247e1882229897a6d19938d80e89b36c970e40284da304a2b

SHA512
e51fba7f1ae5374ae38b491188c0fc5d58d153290f2c96bde4478bff038febe4b6f840ed40ac39aaa4a8a74360d5b2851b045367aa30c5c7e11af62ab37f9b1c

Download Submit
memory/3036-399-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-474-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-398-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-431-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-484-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-436-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-382-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-470-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-471-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-472-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-473-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-400-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-475-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-476-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-477-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-478-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-479-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-480-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-481-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-482-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/3036-483-0x00007FF7D13F0000-0x00007FF7D5819000-memory.dmp

Filesize
68.2MB

Download
memory/4480-383-0x00007FFB8E3F0000-0x00007FFB904CA000-memory.dmp

Filesize
32.9MB

Download