hxxps://www[.]mediafire[.]com/folder/jeltrpxnrfhof/Executor

Resubmissions

09/08/2024, 04:45

240809-fdravs1ajb 3

09/08/2024, 04:42

240809-fbrtlswhqr 4

Analysis

max time kernel
230s
max time network
186s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/jeltrpxnrfhof/Executor

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Executor Cheat.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
2396	msedge.exe
2396	msedge.exe
2112	msedge.exe
2112	msedge.exe
3172	identity_helper.exe
3172	identity_helper.exe
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3828	2396	msedge.exe	81
PID 2396 wrote to memory of 3828	2396	msedge.exe	81
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 336	2396	msedge.exe	82
PID 2396 wrote to memory of 3824	2396	msedge.exe	83
PID 2396 wrote to memory of 3824	2396	msedge.exe	83
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84
PID 2396 wrote to memory of 3524	2396	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/jeltrpxnrfhof/Executor
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe17843cb8,0x7ffe17843cc8,0x7ffe17843cd8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,7291141568721402360,7416401415751925320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2996

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d801c94d7774ac808f01492728066b93

SHA1
c209d4d0b8e2ae953e7ca595b7cabc747c8ee34d

SHA256
050ef89f0103cc6392b805b796a56b19e586c975b65549fcd0c8b209164cbbac

SHA512
d280b7758810c99d3a8c1d63dfa575b806ff60dac16b1ed6b5a14ee8de00d4769aeb6f5550340bc36ffba3a769eadbebee331291f9ef6c27d613d93d2b8ab0bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
cfa5f3bc1530d46ff8e135775047e4f0

SHA1
34e95a1f60a79f31d67fe67de02d3767c574d8a7

SHA256
783eca00d07a49e7fad63addee989a6a398e01c52169e137c3b1a62a1bc4af70

SHA512
9dc61724891241cd9896c35491b592e82aa54ef48b6b8c3bdf57c3576e15f868c2e4544ba52180e521fa6818821a312f390e09a1928dcbfa48b2bf23934285c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
d98c4957ae5bf432e40b0085a6503a69

SHA1
d75914dadcd6ac78b7128f9a594bd7ee47d4af47

SHA256
b19c0e000482015431674ef7ed01c017a019b4dd6556cd957953ba5c9e6c3795

SHA512
49604d9380f95b66c03380594360a70d7addcafa90e4366e4f79b7b4db2cc3d20f49bd6879feb85ff79d2ef65d6ac64f38250db989d30043d643fcb5fb83cba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
598d170f20b4b2d1909b75a4eedd003c

SHA1
b27e86ed8ef44f1c7609a9dd7a15551ed8ee7a54

SHA256
175256ae2f51043d240e383388aae6865eb8d0bb84be8b7eb32d2c76fa1c5f47

SHA512
8844d7883e2460ea78af8f8cb2c3d4486a36a5e2be417381bbb5bafb749b493659e58668088be5564acf99432686aa9278ca2124e7e5850725d64b19a63779ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0c675324d44719660a94484791165b8

SHA1
1239a4032cd225d6e55eca9def74caa5d0bd7038

SHA256
e725647910eb265303f25add685ecfa7e2ecea53944f6923f7ed8f53f76c5ea2

SHA512
9400aac0bead2deed8ee3dd6d220d45c21b90b263c245cfc0763ef24a3c50e28314143d12cbe73410bcd294cd29935099b91faa77d64ca0a0dcd51e0724e78b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d6f25abe2ff87ba78ac0eb6396ec31c7

SHA1
8256c35509c14cdf75e9a492d1e485d4072445f3

SHA256
f6d8d83dd9598b6ce0636ed37b74feca023eed2591d9ea26e407242b36b326bd

SHA512
1727e99700cecc851b578dab1679fa5c63f3e92e2a8da89b23e117a79816d6cd6e9357f39628f044c7427cb86c761525192e44f03ed1117a51c6bfaa0065633b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
a228444f2e7695f91509742138e76044

SHA1
f9e83c7dd1808973238a2821dc98d2411fea442a

SHA256
4df5a1464bfa7c0d19c796ab548b266d98fc9c7ee8ec9e7c6da1eb2b9661f4c4

SHA512
cb79a69c3db622b49132305d433d555b0228d5668e1e7b4a09b3201a7017196cc0558e89d74061d83b65a8a982dc8bc57660f2294cbec7c4950b8274f4e2ed2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0348fa446057c833061621c59f38444d

SHA1
89b6020fa7d3764690ddb09aaf56ccac09bef0be

SHA256
0782c121953ddd9f9ade5311d97247d815d4c047f2b3785197ac55cf57a5442b

SHA512
3c259b4551b64cc3a7bdd02db57c288c22b3d18a31c0375742ecf93453ec303bd01f5cc82bf76550d00cd328cf91737f889d652f7b50220e48df1913c65a7c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb98.TMP

Filesize
1KB

MD5
20547674fec1d00912bfc96604b95903

SHA1
93227f6440abdc0cf5728153612c9b0a9917b566

SHA256
352a42f09fe5d7be762f61610517216399dc3b1478a1ca2499b60c871f875a99

SHA512
ad49e4fefdf71b3d52fc4c726a08339fd2e08b4c1a8977c9428fd90b6d81f9b54bcc00eaedf77cf81b05135f98d09889febc079b86906338f8726b8b95b44f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d8d8bd0be081cb242895064d2cd03905

SHA1
6773cac8bccaff854291625e4132d228980c38b0

SHA256
03cb68662f88d14550454758a2e92a108299922b7f07ff583a71d7bf762f7e71

SHA512
6fd326e667e9e3ec4ad321d219c7fd16bd5544dbb0eb6e81d6c8d8c428193a83a239a0f396f49be741827f3f1b6cd78773cb891da5c37d2869fa8f17d75f32f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2c075527406ac650bfa66c8810e4f672

SHA1
1bdb60a698bd4ce392280a9fe83818b5b74a9206

SHA256
fa43f1a0dad699d7a431664b935cb7e24d3b9e81f82b8e4bc44b9eeafa884d1e

SHA512
1d6adce627bf034519d363c7f2889ae02beaf8423679ca6291394fca601d046a8fee8f18b08a9ded417450baf920b74d625760566f1499038c36e0a754cde595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9b288becaf1cea555ecd096f948f00b

SHA1
1b4e58dfe07d518c81cc42c2ddb38c3130522c5f

SHA256
629e2a42f0b5cefa1b24da08d8223eba3cb540594db7480d780e9b1ac8558cc7

SHA512
b9d44526ede68376b1ad253bc024cf74df96f4a881bfc6a9e0a24986be8b5e81a1436b78ec5b96f6190d36af9f08c527b61d2c6394cf5b69ea61ea0ee69a5fc2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a73ea6e1db27acedbe4055c448f82ef7

SHA1
01769a266d26c4b4b374099606e86b8874ddd55f

SHA256
c3059c62596021e555ec7901361fcde75078ad931bcac6027539930bef8b77d9

SHA512
f9cfe99077e40ac3ff11ab39020d6e159ec06cf50f9b1d156858198d48851d29de8882a18609a17dd30ddea421c6c415683b8d7b14fa30a51ddd1cd76032deb4

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
c08cda8b30daf0f971ed3fca378d480d

SHA1
8c0a3593ff62ec10f1c6e88d448eb8e23aaf7662

SHA256
1af0cf8b1e5f3299794832e511471afa6fcd4a10987464a7c043285cd49f0c58

SHA512
3cae2439b79bc45a0e233e9178224eba4164e535f7b94dbc02d703db37513c73c4ea6cb94cd2f37b2c5e3c37f807555c51bb7902679db2538c3f16a9db1114a2

Download Submit
C:\Users\Admin\Downloads\Executor Cheat.zip

Filesize
417KB

MD5
6045b7dd923d288fc7d78f6faa479ce5

SHA1
712228b91740a70a4cbf04966d7b279621b68641

SHA256
b3b5e02002e3db1028d6f57273cef4c05594352260a3519adf9a3059effb1552

SHA512
5b22c47e6ab4be3668a23a028af27e15b307c2f97722011bb0bfec4732cb26c884d4378eec10512117afb74a5387119067e02bc1800eb8340ac90cf9335ba021

Download Submit
C:\Users\Admin\Downloads\Executor Cheat.zip:Zone.Identifier

Filesize
317B

MD5
17957d4772030b582b328b8c3da2b025

SHA1
f96d5488c9f0e998b5c1d4c89f532cb22399888e

SHA256
d23300d8c3ed2c28912074b1d75ba95f08d2fb6bd514f0fd37ecb0d2958f673b

SHA512
2e7fb410a0518e469ffa6985ab414f751240360d54cd4b0c38e10d6510a2af01992b938adfc6af6f686e1bfeeea07ff4e833bd937bd85908edfd3ad22a200dfc

Download Submit