adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe
Size

3.0MB
MD5

b54aec57135e09a7509d5bd1a34ad771
SHA1

505a83add58ddd23e3abb430e48a96b53591af56
SHA256

adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25
SHA512

6da058b744f7cc400f8a4a127ed3cc29454c1d38827b9955e1391c37bb08ef4980250856c5636a4c5ef0230434faa0c70f914f7fa8b9948239592ce50221e87f
SSDEEP

98304:fghNWhHD8muqAidJYOHD07fLbqDGwy+lppE:ohER5uqAsY6oXqDGw7lpa

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3248-10-0x0000000000A30000-0x0000000001258000-memory.dmp	themida
behavioral2/memory/3248-11-0x0000000000A30000-0x0000000001258000-memory.dmp	themida
behavioral2/memory/3248-171-0x0000000000A30000-0x0000000001258000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
42	camo.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3248	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5580	3248	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
2188	msedge.exe
2188	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2188	3248	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe	93
PID 3248 wrote to memory of 2188	3248	adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe	93
PID 2188 wrote to memory of 376	2188	msedge.exe	94
PID 2188 wrote to memory of 376	2188	msedge.exe	94
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 2812	2188	msedge.exe	95
PID 2188 wrote to memory of 876	2188	msedge.exe	96
PID 2188 wrote to memory of 876	2188	msedge.exe	96
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97
PID 2188 wrote to memory of 4936	2188	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe
"C:\Users\Admin\AppData\Local\Temp\adcea79b5f009bcf143d1a0acfa03e200cba2cbf38ea5eb69c295f6c87bcde25.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/adonias-1337
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe704346f8,0x7ffe70434708,0x7ffe70434718
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1966554573382275097,8107770431001246906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 2176
  2⤵
  - Program crash
  PID:5580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3248 -ip 3248
1⤵
PID:5556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0a2d92faa6126bf60533e47640b753c9

SHA1
f83136bb530ff9f2176199989dbe9d36f7797e62

SHA256
75d51410c5fb70716eaff8f0c8faa191515c9ca2df3e543ece3392f53530e597

SHA512
f036a0b6b285d3b0971a81dfd1a1c2d81b0f72b079b7ed2d684b1126aa1c186992d8db957cce0515876e63d03e6a2c859f757422e82d26364bf0e7362299f06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
c55a0ff379cb32458fc626336461c1e2

SHA1
f2fbbe8ef773c99501d14af0039f1c15d1f94bbf

SHA256
4044f309101531cb3772e44d6fc770c314507eec5c37336e866b8163a54770d7

SHA512
0d7230502968d7c5a4c1c5656d856e035ebf71599b42327f3f440a0117044f101c572709d48fb7773169f0f546c4ea4af8a9e6974b14159db602f32f55948cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f4a13b6a77f12c38d5b00cd7cb596bf

SHA1
7560801b5d3c7dc8492de79cb32e9ae6d4e6b755

SHA256
27f7331a4337f5ac13a0e5f04274edbad28307b23aadef1e76d778c1019c1608

SHA512
261736aeef22486a0e0f34c4e222b4f2bf7a9516a1e9bfc5ae247c83df99545c4c2e99a7277cdd5f890f3bdf3bf0e7883e1ba48738d0cd84c987bf59d81564b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e07c185474fb2e03723c9120cb96552

SHA1
fd217b9f79e98549f28f8a6ad9ab3bd07e114a4f

SHA256
7a531187e1d1778749e556de18c6db92417056bddd072edeae670f3fe8bad6c1

SHA512
b13403197a89e502ef5acb8d6025992328b47b485ce2793141ac749fad974cca36aab7d9bd1c5c3b48463f5413c88fe7956601b1acf4bf217a4e4668006f3da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03118fc698ce8c4bab81ad0f31682fad

SHA1
6ba30376982d90b93508ee587ae9556446c7cf59

SHA256
c56bbf6f292bfd1e55af7107ab827204d5605e32375746df9b1bb6baac443da3

SHA512
1c667f7dcaa62acb385b550c751326f5b4083c8688f39196e3f24462d1aae2f37609a2a814c4fac40703c2e3d89ef39a88546b3b2145c41db58da166aeef7c25

Download Submit
C:\鸭子.exe

Filesize
630B

MD5
06a294f93f08f1b5aca0179d859ddd66

SHA1
68138bf319ca8656c37d9a18571da79310f61d3b

SHA256
919c145b5cadd2933e113fe7211bcc614517bfc180f3aa6afa0728591bfc279b

SHA512
8a3d043dc0afff1744f5056e959228b7fb445284da657fcf8d5c5a951b3a668a9e462355315658059fc1fe625381e0568572a3df939dc430c6cf92dfa9a81fcb

Download Submit
memory/3248-8-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-98-0x0000000006420000-0x00000000064B2000-memory.dmp

Filesize
584KB

Download
memory/3248-12-0x0000000005810000-0x00000000058AC000-memory.dmp

Filesize
624KB

Download
memory/3248-10-0x0000000000A30000-0x0000000001258000-memory.dmp

Filesize
8.2MB

Download
memory/3248-9-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-0-0x0000000000A30000-0x0000000001258000-memory.dmp

Filesize
8.2MB

Download
memory/3248-2-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-42-0x0000000000A30000-0x0000000001258000-memory.dmp

Filesize
8.2MB

Download
memory/3248-43-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-97-0x00000000069D0000-0x0000000006F74000-memory.dmp

Filesize
5.6MB

Download
memory/3248-99-0x0000000075C80000-0x0000000075C81000-memory.dmp

Filesize
4KB

Download
memory/3248-11-0x0000000000A30000-0x0000000001258000-memory.dmp

Filesize
8.2MB

Download
memory/3248-6-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-148-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-152-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-7-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-5-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-171-0x0000000000A30000-0x0000000001258000-memory.dmp

Filesize
8.2MB

Download
memory/3248-172-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-4-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-3-0x0000000075C60000-0x0000000075D50000-memory.dmp

Filesize
960KB

Download
memory/3248-1-0x0000000075C80000-0x0000000075C81000-memory.dmp

Filesize
4KB

Download