1cbaa4d4c817743a7ec88bdc3f8d15200e543a86e0b3374c6d05a15a0762970f

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vibranceGUI.exe
Size

776KB
MD5

6cc583a1f3f4500a524b61255f1d2710
SHA1

7c1a236e291746b781aef5dafbcdefa648f36357
SHA256

1cbaa4d4c817743a7ec88bdc3f8d15200e543a86e0b3374c6d05a15a0762970f
SHA512

7fe177862b1aebbbe32de1aace56cba69d35667a0d337847984380f039fed7c61cda60c2e6c02e6214d4178f715e808089f5a6b4396d94dd87d01a97a88ec8d0
SSDEEP

6144:LPaQf/VaGtX5RlJxeR2CoDnpYRkIE3IRv7I1:LPrHVaGtXV6RToNYRkh4t4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vibranceGUI.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3880	2104	vibranceGUI.exe	86
PID 2104 wrote to memory of 3880	2104	vibranceGUI.exe	86
PID 3880 wrote to memory of 4092	3880	msedge.exe	87
PID 3880 wrote to memory of 4092	3880	msedge.exe	87
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1320	3880	msedge.exe	88
PID 3880 wrote to memory of 1736	3880	msedge.exe	89
PID 3880 wrote to memory of 1736	3880	msedge.exe	89
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90
PID 3880 wrote to memory of 2888	3880	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\vibranceGUI.exe
"C:\Users\Admin\AppData\Local\Temp\vibranceGUI.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/juvlarN
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa67b646f8,0x7ffa67b64708,0x7ffa67b64718
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10291932123863993220,2807535051580793055,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4704 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
278KB

MD5
1c237450dc5c7d595a5fb41ef5420866

SHA1
5308c8fa31cdf1d0eb0ddd071ee73e2e2c98ed83

SHA256
68d3c0f7e8d7c3f8ac6fdbe883f6b9dd1b00387e541d312a0ddcfecc60d2490c

SHA512
df60668c1a77b7042e90f9e8b351463f4775dac3dc8875ac43c72a024689a7726b7e4ad4477c82a0a909e939e494fdd34f8688e7dc365480ad576d43a1beb1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cb40ad867d4d4e06f18002e525fa550f

SHA1
d2f400921d926bada2052f312a35deb19b81f030

SHA256
f2a052559de8187b4ce67b911432165c668db73b68472943499a9a4b0a14f86d

SHA512
29e2b33400e2b6c35ab9ac20e7227c6ce0ceb992ae8b3fcff7da6319b88cdb110786dfa93e5f0cab6091c6698c8fee713758d43dee3019d83dffa396dd27c53f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4877ec4ea93fff37aaef6919273c0026

SHA1
f978bf89801a4118a81ed2d1cbca374af98e2a2b

SHA256
bbc7f08b2712fa5632a380d47ef5437f397ba9acfd5020d810a828a79c60cf28

SHA512
885996302c3bed08be4af5c7c543e911244b51cb3affd08358fdc304507d6db44c5c2c2f50738b131ff0d58e3ab8ab9c9c01e1f318973e6b4d8957b62f556446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ff0d16c9c81a77cfae01523ddd5c6a4

SHA1
0f72c21ef8916e3a1e4b99d5bb89be82b814ea01

SHA256
f990fdf269b40bcd9bd52ce21948c8fd1197f7a65dcf2010b42115dc5fa83c49

SHA512
a571849043cdb321706cd3afef8597c13bbcba883dcbe41363a840a2e1bef9f1fbfe1eae57dd7fd9c7b3db45b5eacf51effaa6b9ccd1fd8a1b012d0aadccaea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aede7d735a0ad2fd66bb1ce7934aa31e

SHA1
422f85fa04b1b7fd95eece599803319000079a1d

SHA256
bda771c1a424794febcc79f44cd57ae531d197dd7034a6cb97c868c338e4ac06

SHA512
05e1b160653be45303032d43034a6a5fd94b8621652f288e5c2f25bfd0d2e7076224e3499e9e36ba7e85596307aaa5dc1802fa083c0fa6fa75d6035219dc9cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6659ab7bc4fc4617cfa02db9a8e23f8

SHA1
d1ec1790a655ade1f10a3f574c32c65fa0ee6ad2

SHA256
8f0b5e228bf931348e644b0ed8b64d2089b6dc72f94ece06093ea9381d53591d

SHA512
f385674e47f437cce3a180fa05043a7e02fe19ad53c8278fbbb8471768e390b2b7f62597dc81c4226dfa32873c4ac3d2422fef4c87e4850f9807eb4a93b6cdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ea60.TMP

Filesize
1KB

MD5
5afb36804517b34bc90da70fa1be8131

SHA1
64f5aa302a4a9bf398290b2755b0f4224539af46

SHA256
7468d13df3957da97ad026498cf37f74aa021c471ccf0fdc17bae2c35bdc16f3

SHA512
53048e84bd564544a74a28db25b08425ea15711dad619542d942e8487efa4aca3de4b4a088f16b19b9b89cc0df4beb2335d9fef3bdf2daf7ea6ed65770f4919e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e50a548d6d18934d3aa3062139f7562

SHA1
5d7c58ba7625ceae0b005bb89a3c7d50e7e91365

SHA256
91574aff0139a71dbd5593e242c247a74085d773b00838359c97087303cf5542

SHA512
9c350cbb7c51f2684bea216714c5694b081cd74b65c198306cbf1905979e492955370afacb8fd36b737a2e2f058c41436c767e80a94a966dc76430556110d498

Download Submit
memory/2104-5-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/2104-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2104-3-0x0000000005630000-0x00000000056C2000-memory.dmp

Filesize
584KB

Download
memory/2104-305-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/2104-2-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/2104-1-0x0000000000C30000-0x0000000000CF8000-memory.dmp

Filesize
800KB

Download