hxxps://github[.]com/r7pha/Prisme[.]Project

Analysis

max time kernel
112s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/r7pha/Prisme.Project

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\佺㶬듧춨	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\佺㶬듧춨\ = "prs_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\鿙鰤㤀蠀倀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\鿙鰤㤀蠀倀\ = "prs_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\.prs	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\.prs\ = "prs_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\prs_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
1976	NOTEPAD.EXE
536	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
428	msedge.exe
428	msedge.exe
4808	identity_helper.exe
4808	identity_helper.exe
2532	msedge.exe
2532	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
408	OpenWith.exe
4036	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of SetWindowsHookEx 45 IoCs

pid	Process
3580	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
408	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe
4036	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 3176	428	msedge.exe	82
PID 428 wrote to memory of 3176	428	msedge.exe	82
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 4804	428	msedge.exe	83
PID 428 wrote to memory of 2904	428	msedge.exe	84
PID 428 wrote to memory of 2904	428	msedge.exe	84
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85
PID 428 wrote to memory of 1380	428	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/r7pha/Prisme.Project
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd09e646f8,0x7ffd09e64708,0x7ffd09e64718
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2032 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,13010081705692402485,4352153918836550389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:408
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Prisme.Project-main.zip\Prisme.Project-main\files\templates\Spammer.prs
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Prisme.Project-main.zip\Prisme.Project-main\files\templates\.IMPORTANT.md
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85169b9c-f8a2-462c-8899-6e6352e563b5.tmp

Filesize
6KB

MD5
15a8c8a162ef3ea09c210244df448ad7

SHA1
f9efeb0d6732a33ad87b773d2b50cbd73d510150

SHA256
a85eddd1c0247d0aa0bf1b5df7d6aca02981cf6e420f0383d5512c224dcdfb83

SHA512
0db29c5a89500fe297857da8e23d1b0c28040f336b36e6963b00c4369448b64eb5595134c890a0e8bd8877c09cd71e0264b4213f1c10186f847cf6baefe81493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
04a4dac273cdf252c92b693c99175e4e

SHA1
8960e97f7d0bcf48c97e4c3beb57a7aa9256d728

SHA256
24c697f598015ff75c13fec29f12b551cbc5472ca412e3fcde4b35b27df3972b

SHA512
9c8fe84491842a5a18dba2c1f6ecca5589aa6848d4a52f1a081a2142ea9614822f25cd9b3b6681be2836e32a854894d9ec7b24145aabebe41e7d2bb2919a7ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
ec360c67d7ab674fd38034e971b8c213

SHA1
20880ff8b4282a0eb7620c577a57419d613b88de

SHA256
c6513e129439350e72c738b6a83d0117e098c74c79abcf272c1a1cc9b2c8b24f

SHA512
e43e294168ffc608405331f803fd7c0041db617eaa3b496030d00ecc4ee3786dbb4096c55131107e3f60d2a1eec433ab186dc7d8041c824022e24ac7ded22276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7832284c33a83e836c494350a584ef43

SHA1
d59d63d4ffff50b9821dfca2d2ed93ec001fd494

SHA256
5e5aba661b7b7dc6170d8351a2e656c551d360f229c5acf6cd51b2e800375656

SHA512
83b2278171bcd3a649c00adfb2a26587af9d3d0f58cb4c535afdea2bf0d101363575906d487cc9552a6dda8ebe2be4d0e3ffb579730424334b3115b36eb7fd0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cfd6cf883321d94a5ac7ac20ac7e589

SHA1
146a9049dabf17c0e7bdced8c21c5d7d50850345

SHA256
7908016937ee3027a9f6222822c9aa126d6a4a28abf7bc342fb4f06e6dfe678a

SHA512
5ed2dadb0dfe70f254c866def92a98a679c662acf01384266005c65302292c021605dbc84249296d29d4465b756b552760319da41b4464a5d6e0f066cc7ffd8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab858451e54624c4810e0eb802657915

SHA1
cf3a5221e24607c7ac7f08947d3b2394d6695871

SHA256
b6fc0a1a119a8ce61a32b0cc73815a69f497a8f25e1b9ed82e453252f86f91dd

SHA512
125ef0f71066a18365bc9fa8ab6d8b2d165c6f9d24c2bbb3660ec55f8254aeb601108fbd1669288e3e3d5fc32a512aa574147bfeb2b67e6bfb27250cf812ea44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b34191dad46f3ba4dfc4246ef288b7f

SHA1
edb90ef439e4b8fcd536da00b9263051baa3f1d4

SHA256
f1c5719dd4bf136192b69eac2ba0b984626152e42b22ada56dcc327af3a052a0

SHA512
ded7578a1d9f1c09e84e90625886e2bcb4868814d2ce7616285fe1a96eda6cba31ebbb781b386c82a5b9bd9c5e3350aa2f708b6175ec13048e203fe24405e5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585e28.TMP

Filesize
874B

MD5
e22e5f0dc077a1c82bd335daaf1a551c

SHA1
823cb903d2728382cc234b37ba58a5d764c48e72

SHA256
80c4fcac6cc5c065f7e262ac3be7ecdab28048bd3450b3eb51f7e3073f4c6f99

SHA512
f52d2623a47ab8bf062a655c14bbb3b0cd9b91c58238e583eafc9f3eca4a9beda86b63c2efc76b940c916a4ea59423a9a11f9f70fa5e1859b5043efa088ef249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
712d1d7cf42042fb8a49b6fbe609ff1b

SHA1
588562e9f47fd61d8f46f0b55c5907854f33abb7

SHA256
b1d81380621d4b4f74ae7d7ce07fe1429c8fcb42df9ed459ee6d224600e34496

SHA512
264fa939a8ff32a31f4d6559bc117e00535c0e404bc606ce17cc4ac19998ed2bcd7492337bacb3757b87b7ae38dc355cc5a1b4833df742f459cd8347e22b51d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d68aa0791085638afa8533dcbdb9d34

SHA1
ec070bcaf7f03cd2db929462c872fe8c64863ecc

SHA256
bb347c793fcd8efb25678833e7b898cab7ff007a7687e01ccd11e58ea2e47800

SHA512
efa6ce2fa85552494beb211b124fe5820e3f14f6015be899d07abac23fb6a0e5185b192a27759ba799628d58b87bc6f07556871fc3b092291753fc4352832be6

Download Submit
C:\Users\Admin\Downloads\Prisme.Project-main.zip

Filesize
13KB

MD5
47f92e832aa8a8db21ec959baead0c95

SHA1
6607f3cffcc671204503c0dc5fce635f5c9857e2

SHA256
a05e10ac48433e3d0149f35caf9a120836e3492598f925540c268761c5fcc073

SHA512
c8c8c93916438eb3b8726a270c35d9e010c9556838e1b69f66125bea026b284e2344edab9b5fac13bbff6e326cbd32980b3ab35c7e97d829101d815fedf98774

Download Submit