51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

Analysis

max time kernel
1790s
max time network
1770s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-12-2024 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RippleSpoofer.exe
Size

15.6MB
MD5

76ed914a265f60ff93751afe02cf35a4
SHA1

4f8ea583e5999faaec38be4c66ff4849fcf715c6
SHA256

51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b
SHA512

83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac
SSDEEP

393216:QAiUmWQEnjaa4cqmAa4ICSSF1a0HPRV8gtFlSiZh5ZlZ:bhnGhMAXSmHXFA+

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RippleSpoofer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RippleSpoofer.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/1772-6-0x00000000006B0000-0x0000000002330000-memory.dmp	themida
behavioral3/memory/1772-7-0x00000000006B0000-0x0000000002330000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RippleSpoofer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
13	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1772	RippleSpoofer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	RippleSpoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018527317-446799424-2810249686-1000\{DF6B8E13-EE6C-43B8-BF8D-C3FBC3C6BF78}	RippleSpoofer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018527317-446799424-2810249686-1000\{E4DE1913-B4EC-4A44-A4C2-784489BD059C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
1992	msedge.exe
1992	msedge.exe
4184	msedge.exe
4184	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
3120	msedge.exe
3120	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	RippleSpoofer.exe
Token: 33	3888	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3888	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1992	1772	RippleSpoofer.exe	80
PID 1772 wrote to memory of 1992	1772	RippleSpoofer.exe	80
PID 1992 wrote to memory of 1996	1992	msedge.exe	81
PID 1992 wrote to memory of 1996	1992	msedge.exe	81
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 1596	1992	msedge.exe	82
PID 1992 wrote to memory of 2716	1992	msedge.exe	83
PID 1992 wrote to memory of 2716	1992	msedge.exe	83
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84
PID 1992 wrote to memory of 5040	1992	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Qt5NMSgdzU
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd309c3cb8,0x7ffd309c3cc8,0x7ffd309c3cd8
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3532 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2448007472644508691,14722913590813231741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5768 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1536

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
2ae94c806fa6c7ca409c21bb0e35ce59

SHA1
6cfb69dd603ab24b93b71abfccc2166d94599df3

SHA256
e42eda301d3bdcef3d62edef466763c169fd79e9bb49a7090ef99fcde8b3666e

SHA512
fe204124347debd9d9f9a424ddd2d81a1444b5337d5bc5e099f98cefff783460efcc5f8563ad376361ef0f5b93b5f3f9f72a9d35d27de69fc5baaacc06c9da88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
536B

MD5
6d6bf36b98e64069d4f73a1dd35b1b64

SHA1
390bf7f93308fbfe005e298f39f664fdb35a8708

SHA256
2921102d2301c87be9c6d1970b47a4e3744a6ca085f81ea2e97d9645f539dd50

SHA512
8591c03430c86ee1ec14e8d6f20c29087e5096597cc01bd57dfe35394fc8ca6fbc2866f5915270b47fc43f85164804feb8532c6401c1639843dbba1a75f6759d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe3a905fe1830565955d73db59f30f16

SHA1
67fad75e048fb6f50a26c1dd6bd7f47cb3222546

SHA256
66ea10051aaba5527da7c341a22b405c549d8866a0cb514f38081414dd83d78b

SHA512
76e65b1cbac524cba3ff0455e58e71f3e1602e48dd83b339feda8f3294a461121b01fcf51cd76a69de875c5e5a920f8e6dbadedb857650ecb0dd35a72ffff159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a326674e6aff0a91291434bc35ecd23

SHA1
995a3afa79206d577ddc0811420a7a93d1027cdd

SHA256
6f0486475fd5e98b60d25f8bcad7f0ae9480a855b8ca87e59ec117693bf62b92

SHA512
faf2c777887b712fdd297effae6f0c0418f46de791afcb38256b9ab99a119b140741f392015bc3e84128914f1411442c07091c8c6ded8f6595ab0577a48f3b9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
15468e1db5b44a83d531e9fd6cb0ca8c

SHA1
30a27fda01fef7706f12e5dfc64b494d75e2a227

SHA256
0cc18bf9f60d11612e0c1afff676763e4c886dac618637f27148c7a1b56671e5

SHA512
de86450e9ec259c45c2f0ad6de63f3ee72115bdf78b9543e7dc671a8488bd1824a00e129d35335dc16219281061fb5324ff7b95184559146120008e92d3c0527

Download Submit
memory/1772-10-0x000002463ECE0000-0x000002463ED92000-memory.dmp

Filesize
712KB

Download
memory/1772-28-0x000002463FF60000-0x000002463FF7E000-memory.dmp

Filesize
120KB

Download
memory/1772-13-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

Filesize
756KB

Download
memory/1772-14-0x000002463EFC0000-0x000002463EFE2000-memory.dmp

Filesize
136KB

Download
memory/1772-15-0x000002463F030000-0x000002463F244000-memory.dmp

Filesize
2.1MB

Download
memory/1772-18-0x000002463FE40000-0x000002463FE74000-memory.dmp

Filesize
208KB

Download
memory/1772-19-0x000002463FE70000-0x000002463FE8A000-memory.dmp

Filesize
104KB

Download
memory/1772-21-0x000002463F560000-0x000002463F574000-memory.dmp

Filesize
80KB

Download
memory/1772-20-0x000002463F550000-0x000002463F558000-memory.dmp

Filesize
32KB

Download
memory/1772-23-0x000002463FE90000-0x000002463FEC2000-memory.dmp

Filesize
200KB

Download
memory/1772-26-0x000002463FED0000-0x000002463FF16000-memory.dmp

Filesize
280KB

Download
memory/1772-12-0x00007FFD5626A000-0x00007FFD5626B000-memory.dmp

Filesize
4KB

Download
memory/1772-29-0x000002463FF80000-0x000002463FF8B000-memory.dmp

Filesize
44KB

Download
memory/1772-27-0x000002463FF50000-0x000002463FF5D000-memory.dmp

Filesize
52KB

Download
memory/1772-30-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

Filesize
756KB

Download
memory/1772-11-0x00000000006B0000-0x0000000002330000-memory.dmp

Filesize
28.5MB

Download
memory/1772-0-0x00000000006B0000-0x0000000002330000-memory.dmp

Filesize
28.5MB

Download
memory/1772-9-0x0000024623E50000-0x0000024623E51000-memory.dmp

Filesize
4KB

Download
memory/1772-7-0x00000000006B0000-0x0000000002330000-memory.dmp

Filesize
28.5MB

Download
memory/1772-6-0x00000000006B0000-0x0000000002330000-memory.dmp

Filesize
28.5MB

Download
memory/1772-4-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

Filesize
756KB

Download
memory/1772-3-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

Filesize
756KB

Download
memory/1772-2-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

Filesize
756KB

Download
memory/1772-1-0x00007FFD5626A000-0x00007FFD5626B000-memory.dmp

Filesize
4KB

Download