hxxp://vxvault

Analysis

max time kernel
108s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 18:53

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://vxvault

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
5032	msedge.exe
5032	msedge.exe
2844	identity_helper.exe
2844	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 5096	5032	msedge.exe	88
PID 5032 wrote to memory of 5096	5032	msedge.exe	88
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 3904	5032	msedge.exe	89
PID 5032 wrote to memory of 4824	5032	msedge.exe	90
PID 5032 wrote to memory of 4824	5032	msedge.exe	90
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91
PID 5032 wrote to memory of 1852	5032	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vxvault
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6487438184765965468,4088731679896514059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
051f1070ce84d0b73beb3c9c23ad3fad

SHA1
65f51b2e32aa0b0cd37729032c433a0130565cc9

SHA256
0e32f846519003c02af4e8a030a4b22bb30a46d40542fafa410222ff25933a87

SHA512
35fa8d7d3394c1459b1ffc8b5fa001cd7b1a5fd552fd03fbb4b5a4de6ec93941a17efa87706f1027b075369aa35c7e24fdc3c0a111c4733d7ecdd87fbb64188e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
400B

MD5
ae6a3dd55bf310fffcdea6d9574a1fa6

SHA1
623c667654fd1c3d5d0b6c22d7d85be67bdffbb9

SHA256
068898ef2cb92d64bb1069c92ca589a510c5462bffb8a7a10f2ada71783b1793

SHA512
ae4d96e7ae11a9893e18c8935633321c8c15d4ab0a8dec06b196f3ac6ae1ade92a30b9531901d0ab147c9ce8d95073f2c8ce49b985f620011db54b6b55e769b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e505dc06068e366b3e7f3d41f6455858

SHA1
5d497abd62a81868b4a5b961abe92c653b99913a

SHA256
b80761dba397beab3d641bd21249f32cee249c1d7a55308639e4a7244f60f82c

SHA512
175c5104325a5fe46dc4604bb07bff94c028b48234b5d16c85fb65c05685703e4514a0c6faf758dbd3413bb07f47f915e5db4e0c628f295ae77f751e0a2e1444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
849849fb8fcb411b45fb0ca6881c7e8f

SHA1
5a97afc155efeb8079e612fb7f1f52229e93d9af

SHA256
476ecb8a7e24b34c5d15be2a9574593174bd8764818c63597afabe6c90539b45

SHA512
c9e7cfc2fa05a425c7f3eed714cb88ea26bef39741883ea8bc95cd28825b1f603ef81302bd20b99c193d95ba61efb4d387b157d751d77ce7c03a06dde88c3d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ad1f816288ad8ae0f84b20a40e3937c

SHA1
5fa47b169f1dbe60b2d9b12cf50b63254fa11e03

SHA256
59876da93bbf5212c9892f5e8fb76d0482f3d6b75501c1eca269b0b1db31c13f

SHA512
a6229ba6acd476424897ae3f8495a8e51ee0495ef33c24caa83a3a06431f615c608a55d86184357b5cfdd526f637a801e555952eff815e96338c3a3bff2398f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c6fac4dae1c778a50d50825b5064796

SHA1
d8f7a345297b1efe69bf748c0fc4ee1f94e17e26

SHA256
881c2bfe8d1a512e08e2490e857e31324deba9fe8e3639d98829c23c7f8fcfca

SHA512
de0c6cace7783b29987aa9c32ed1ec05bf58d16cb48c37d21210913d12b24450e0d5e6fa828e42713ca712789a8b09a9fab86c2f81281093e4f4f0085e437ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeeca496d2a2728f2b42252aeecb0291

SHA1
4c03ed4a261b87af4a791500b91a86207c637c8b

SHA256
96014bf474f27c644c9517b93c9114c50ed020f45d8d3fb51ac32cf72357b27e

SHA512
addcc4941fcae30e3d296a1d7d34539780b2acf3ad91116c5140d5cbe2415269df9f0e9f06f32f5f155da1ba215bc8507753eba9240d12b8c06094efd62fb9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb5ccc8ca7b7524e8678eb5473c030ad

SHA1
45c723ddbc1f3724a83a703da74e8b392a7e03ed

SHA256
8952d4521e54009f8886dfbb966bb465947493b8e8d68710bbc1573691f6bde9

SHA512
d5f1e2a0b3f74bc5db7587d4f5293e6e5d350408a16de9437f3c9473fbcd1a6918ae2faaf554a4492e7fb07964461c827a1fb8428b4545bf66efc111b7ac9b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d2d61e1a522d7696f97095592ba13352

SHA1
c6ff8dd11accc4e2c76212f6f55f2dc538416788

SHA256
f4824aa424e96683cfd3cf965eac935773517ac53082ee0c0880a3453267ca72

SHA512
8d172d75cef7e0050200bc6442e20355648b1e18b9f19b3a4e0a5c28f4f26aeabd527de7e4bedeb3ef23add2993136f81b6f1e73b9a13485bfe614b2f6a2e869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb5d912f-b67d-4570-a6db-62a6bb267125.tmp

Filesize
12KB

MD5
4b97920d5dbb46f7c0dc91e0bcbc2f8a

SHA1
b2cbebef66c5977555757cd52732fcd313252e06

SHA256
be23510aa0bd8dde4161ddfd9333a76374ff15e14af6fd847a7ae3a85f59e57c

SHA512
e79a666606f50e65c2d21418bfa5abe0cd3f882cc349aac9b8f2c9cb0ae25efdc43cf17a255622603bc8a35272fffaa531eed66d461b47da85817aa5895143e0

Download Submit