0155e34c5ad2f5661c5ebc2c6351ac2afe95246bf659e8cd0b0e1a7bffabc5de

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bplay.exe
Size

12KB
MD5

e057aa4a56a9a2a628a8053f25a27d7d
SHA1

d839e5258bbdb871c746c2cef52e336487535c47
SHA256

2519081eca56fadcf3b62e7cb22e55a1f839b9055e9f1e404fc28145d149e913
SHA512

d968aa76b1483a14b7d829c755a99c7ad09163d18da6806f23b3a33664292f16a4695b596b0d2be619a3b6dc909cfcb8cb7ff236641d1cc012e4f438364945e7
SSDEEP

384:azbge2/99IpWUFyCKaMgXGT/bl55oqyfvN:azb619IpWUFyQiB55aH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral28/memory/4976-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral28/memory/4976-2-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral28/memory/224-3-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-5-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-6-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-7-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-8-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-12-0x0000000007F90000-0x0000000008173000-memory.dmp	upx
behavioral28/memory/224-13-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-14-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-15-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-16-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-17-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-18-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-21-0x0000000007F90000-0x0000000008173000-memory.dmp	upx
behavioral28/memory/224-19-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-46-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-49-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-50-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-54-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-73-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-99-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-118-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-143-0x0000000000400000-0x00000000009FE000-memory.dmp	upx
behavioral28/memory/224-208-0x0000000000400000-0x00000000009FE000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bplay.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
224	bsplayer.exe
224	bsplayer.exe
4040	msedge.exe
4040	msedge.exe
5080	msedge.exe
5080	msedge.exe
4340	identity_helper.exe
4340	identity_helper.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
224	bsplayer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	224	bsplayer.exe
Token: SeSecurityPrivilege	224	bsplayer.exe
Token: SeLoadDriverPrivilege	224	bsplayer.exe
Token: SeSystemProfilePrivilege	224	bsplayer.exe
Token: SeSystemtimePrivilege	224	bsplayer.exe
Token: SeProfSingleProcessPrivilege	224	bsplayer.exe
Token: SeIncBasePriorityPrivilege	224	bsplayer.exe
Token: SeCreatePagefilePrivilege	224	bsplayer.exe
Token: SeShutdownPrivilege	224	bsplayer.exe
Token: SeDebugPrivilege	224	bsplayer.exe
Token: SeSystemEnvironmentPrivilege	224	bsplayer.exe
Token: SeRemoteShutdownPrivilege	224	bsplayer.exe
Token: SeUndockPrivilege	224	bsplayer.exe
Token: SeManageVolumePrivilege	224	bsplayer.exe
Token: 33	224	bsplayer.exe
Token: 34	224	bsplayer.exe
Token: 35	224	bsplayer.exe
Token: 36	224	bsplayer.exe
Token: 33	1888	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1888	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
224	bsplayer.exe
224	bsplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 224	4976	bplay.exe	81
PID 4976 wrote to memory of 224	4976	bplay.exe	81
PID 4976 wrote to memory of 224	4976	bplay.exe	81
PID 224 wrote to memory of 5080	224	bsplayer.exe	83
PID 224 wrote to memory of 5080	224	bsplayer.exe	83
PID 5080 wrote to memory of 2152	5080	msedge.exe	84
PID 5080 wrote to memory of 2152	5080	msedge.exe	84
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 712	5080	msedge.exe	85
PID 5080 wrote to memory of 4040	5080	msedge.exe	86
PID 5080 wrote to memory of 4040	5080	msedge.exe	86
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87
PID 5080 wrote to memory of 3064	5080	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\bplay.exe
"C:\Users\Admin\AppData\Local\Temp\bplay.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\bsplayer.exe
  "C:\Users\Admin\AppData\Local\Temp\bsplayer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bsplayer.com/en/bs.player/download/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7edf46f8,0x7ffd7edf4708,0x7ffd7edf4718
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3492455809713196961,18155114295528165174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4bc 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ba2b0339acf821a2a44a5f8e2a6f69f5

SHA1
0bba18d1a40b397434a0ba86fea3d1de5c13a65f

SHA256
8a6ced2b355600584cd5d0a24d84e12383dac0fa7b9bbd9ca93e60039d02eea1

SHA512
1481e9faed74178479065181602e6290a4e17312ff560c43d41d80d01a5b2548d03ec6a9fa359854fd1b926036a124769e54425574ea7622f883762a91d73c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
61b3f9bfe25545bdc335729789977106

SHA1
ea54359cca761cf5def04469c9210f6e35e2c7a6

SHA256
6aa9fc1418f32951a8eafa635e9ec49304b541997326856a41a0658b2387fe48

SHA512
d49f5ac1bf23ebe1850447fea1c5113366fb72e1b1af63687736ebccc9fa66dca5a283b21cf0020c49453075af48c23fde451cb453708a877127c5f100b5439b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
95864668f57a0cca29703558c8009a36

SHA1
f794b6e28b0ca797be29462d7cc987c6bf4dacc7

SHA256
9603343790c5cfe4578cb94d6b03df08de29f01713aa0ec7ce3d0bbba25a8385

SHA512
0ea3702b2389ae9cc901f4cb6878332c70c1615bf4349672c02bde206d53342c95b610b442333eeb0fb42143d5212af282e70446b9c2da116ecaf3871e33a5d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d0faf368725401c2536d3a9f43f024de

SHA1
ddae2a93e5905f10e7facd088d1e3cb5eba4d88f

SHA256
b35d754c555c50f258cb2ee7a68c98f307a60f1e5205e2425f4cc188d35b62ef

SHA512
b8cb8716c8bc80568c7155d28415a006b005050adf5a848790747478dd44f5fcc2fa9b3751508a40d5876934f36e8b854cd67f3213de0f159b2bfc5a6cd67691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3bb8fbbdb7670172899a66d879c2f53

SHA1
f82979c337e1899fd98fdae7224d2dc3dc15df1b

SHA256
d77c168c4e41edd6ed0cceefb57362879952a4df67305e1b3c41f4e812ae85d1

SHA512
c5437ddc6d5b4089c4acb3355221e765f6adc7c4083329be8d2b720016445d7b87aae386e56903789e14451a579b660f399a6e08708d31a8a7a5749a259aa767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ecd9b9f04af5259fb8df4e9e4ad42161

SHA1
43611508f8cb09c023b7fcf393b54fad53b6e6f8

SHA256
2c1e14352aab2092986e865361588d312801c56a3d732e2fc9863abb57f573a3

SHA512
d98e9b4ce297e1d85126b873818275a86d1bf426d44a5f9ef4da87927becd7588387c84f7208e423ceed42509e83daed7147ff513cb03b87d8e1ae7ae6730e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5440c7cac0ac14730d5a993bccfc9130

SHA1
4d2269cf9cf41efbcdf68afb234c838a0512082b

SHA256
4663cde6bcb64d1b5f58fa5e383c2c1bcbe145f2abbf4a321461f53dbe62aecd

SHA512
70bb60a612464b32c65cae3d76123d50cdc1ff5edf2f7b580760abedf667923e04423c502b0b3fbf48a0c1b4d5440d77a0541010e46a2345327d6bbb0e012efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f4af1caf986aada05ab934883f314ff6

SHA1
20e8fad740c745fd9514b1b6ce013e0ff386d22f

SHA256
de1a4ef55ef6619a516b1913ae0464304076b43bbc0b53419fd221c9f83c01d0

SHA512
8588888eea4afc68ae757e7a36a8018017475ac8bb09b3692617f7177be6622c06cf32cb2ab92634ee5f707b12788f9bbea0e16e6c7ded22fc171e3554ce7975

Download Submit
memory/224-13-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-54-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-17-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-18-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-21-0x0000000007F90000-0x0000000008173000-memory.dmp

Filesize
1.9MB

Download
memory/224-20-0x00000000058C0000-0x00000000058E0000-memory.dmp

Filesize
128KB

Download
memory/224-19-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-15-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-14-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-243-0x00000000058C0000-0x00000000058E0000-memory.dmp

Filesize
128KB

Download
memory/224-12-0x0000000007F90000-0x0000000008173000-memory.dmp

Filesize
1.9MB

Download
memory/224-46-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-49-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-50-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-55-0x00000000058C0000-0x00000000058E0000-memory.dmp

Filesize
128KB

Download
memory/224-16-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-11-0x00000000058C0000-0x00000000058E0000-memory.dmp

Filesize
128KB

Download
memory/224-8-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-73-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-7-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-99-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-118-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-6-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-143-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-5-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-4-0x0000000000405000-0x0000000000406000-memory.dmp

Filesize
4KB

Download
memory/224-3-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/224-208-0x0000000000400000-0x00000000009FE000-memory.dmp

Filesize
6.0MB

Download
memory/4976-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download