hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

23-02-2024 18:12

240223-wtnsnsef55 10

23-02-2024 18:04

240223-wn3dwaee82 6

Analysis

max time kernel
2690s
max time network
2648s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23-02-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
69	raw.githubusercontent.com
1	camo.githubusercontent.com
2	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DesktopPuzzle.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	Process
844	msedge.exe
844	msedge.exe
3980	msedge.exe
3980	msedge.exe
3212	identity_helper.exe
3212	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe[email protected]

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
2160	[email protected]

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

msedge.exe

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3980 wrote to memory of 4300	3980	msedge.exe	55
PID 3980 wrote to memory of 4300	3980	msedge.exe	55
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 584	3980	msedge.exe	82
PID 3980 wrote to memory of 844	3980	msedge.exe	81
PID 3980 wrote to memory of 844	3980	msedge.exe	81
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83
PID 3980 wrote to memory of 2480	3980	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffee1353cb8,0x7ffee1353cc8,0x7ffee1353cd8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,8116849655727278454,6237489190444265692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4068

C:\Users\Admin\Downloads\DesktopPuzzle\[email protected]
"C:\Users\Admin\Downloads\DesktopPuzzle\[email protected]"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c85ddcd47497482ce37bf21a77855cd1

SHA1
65dd1b9cc831565d8efb7af16008858d4a5e1b72

SHA256
2548192efa0d25d6a046bfa72dc46dae14b14e45245aa2ff1c95a64719267f80

SHA512
1dc6ba41dc4a8597b76def68df92b4f148e9665599a318b2f7c8857bd3d3734f9ecfe8cabfb679ba9a1918a641e58cbd5f86626c63c109efe1b5564a4a1cd6ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
301f220c1cafcec13a2495920bfe23db

SHA1
35a110f38f51a89eb7fcd161885de02beba91d92

SHA256
21da1112304e0e0e4c9ae5836606c872e6a50fa7b17437639d4a5fbca530ee55

SHA512
802c38d265c6716626876a83d787ef10a2ed62220d9b34115bc222651f81095a3ae6c0d49cc2b40f720fe5eea9c2f8c5e91fde84fc1b8efe597ba62d1c6243fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
d9b2e26a92e865ac8e7282dc021ea098

SHA1
2e5d5a77b516b51a0102af085eeed51c6f73adff

SHA256
85c959ae71e198d7b53171156fa3d2699a42dbe23f80cf3a17bed7b8b13a933c

SHA512
58ede42069b2e2600c0c9b7e07fc2519c99561561283df7ff5f330a97dbdee0be0c1f44b3553a0d962a60832be95d4efff8914f28abc3fe59872d91d3263f465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
aadae93b8d636d034aee972c3635d7b5

SHA1
d8c1119ed585b5403056f37515b98d32d3275ab9

SHA256
baf498aa585a836559bfdfeba511aa8392d8fac7d57e594062dbad9bbd5c8327

SHA512
0a27888dc32f54cf0f1dff75e1f38813c60a0e0d04c16eb2f0a6bd898455f31f0008aa550b1e36f342527d777e71d9ef3e7e88788366f6b64cfdf8ece6e7bd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7161dc2139b4065975803b6d86ae76a8

SHA1
fc8ee65f7d23e58f159c16e06a0c258e3d40400f

SHA256
22a4cc5c3b53c1e2afe50d46b5a5b19804612846b14afc87ade5b825fb080864

SHA512
0aaaec468d4519bbc95d621dd939d6a332623f62845aea0bbbee41a5bf07b0b9f78307e9e494db222194f0f700190d2b07a51021c0a80d21c901bcb99b988c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a8b4b58f96a4a2b0f94fb4ef3dfde76

SHA1
c95c1d7d396f87cd01c3ae702599453c9fbc658b

SHA256
874fec6d26a84abc1a9c14e90588331cc228aca9be448511e534d32252417781

SHA512
665dcb203f705b2c0370efdf417c2ad4a10b1998763cdccac3070e862a3378cb2da4849df8f0c32e89bc9083e9f1a81d862621d6cb0cccc4f9aea3131d019f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c9fa68b7e84824e79fbed62357851b2

SHA1
efbdef3c5d5487d779142b079f47873126a3482b

SHA256
8566d4cd45820ddd765205ddc88ac16b0e599156f24ef57e668eb4f6a2864740

SHA512
ac865063099fe23d577c47eabc43f5c7bc36fb5ac8b8ddedace757b6ebcd83c94a447c45c8094193a9795dfddbc5ca520d7eebc37e08e0c4c13080ddc753a2bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad4bd30d5744c1fa74d71b75fb3e9f8f

SHA1
4a21487e6ef422cce6f0be9f58a918f652a24467

SHA256
91eabba451f3343f598c240e7ff4d9340a3d2d7607ca1d1e3d0c87138be14add

SHA512
4a41bb6cb5b0228e0502bfca2e48d973c64f2ca7665e65619f744f1e58030a77931c0efb6b837ca97bb0c9836221fd9395026ca89666c1ba636be069594903ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
54b776786e34d7622389a75ec816ad6f

SHA1
2dd0c938bf799134e1bd7fbb80bf7a6a3b0bfff9

SHA256
61495ff9a8cb726a4afdba13c5dd5280f07082c9308b92f725d92a25f0097e0f

SHA512
067858c913d3125062ef4d750e55357fa99bf30fba472a9f815e0a587739c206edbe1bd257bac6ffc8ff18841844590305b44c44b3d14b8ea400e331826e92a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68475bdc91e745d4552f75e68ce4f6bc

SHA1
1824606a0cca18d6b2b58bc765e281195fa5fd8b

SHA256
05016ce513a77df6beb636a82f9b1f6b4abc2f57f2686f031649eff5e545d57d

SHA512
36ba106083e2edf3089abcdf106a1a2095c9a0a040a4081242f005c6ee966f68e85ef5dbf8760dd3e22375956cd935731bcc4e3a78358eedb039dd3c3dc55b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9022cdd2b0917dde345f5ec189615d9b

SHA1
cec8c0bf5b669d9e73fa8664230287028fe1cb5d

SHA256
a0893fcea30dfb022d2b063c72eef4c665a14c8f738c87aa31ae916baeedef7f

SHA512
f6c5b90ce5e6b2432cd534f9b41350f92f68644e92cf1c7a93a2e55fb0d64fd910978ea4d3e0367182b653fffadaabf711d90f5c4916965c9f3019d559d4c696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6cde95fa9667fe604ae2d8f471bf4c0

SHA1
6d8a394f560a31b85b567cfff00534bdc0047566

SHA256
b868eba98610ea9ce80f3f680c8de4d11071174f537979ebb6023ac1704c873a

SHA512
f6f7bd37601ea11f4529e54bf50b46699814e7b0ecddc63253191e6b64052bac3e60142c86cec2f4c58609e8d93c691481f0bba91474629c980700f4d2e7e011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bf3251b30b7fd244fa33cdb703ad0f8

SHA1
7426105e732bfc049d3dd75a4eaa2568df41e59b

SHA256
f3e702ce8d252887296f5cfbde283af0cd07e1dffb217001f32841105fd3a3c7

SHA512
55d1df3fbf58555566505120cf7a9758bdecc4bf9bdab1cd5fc64cda88128725b8aedaad90eb3fc9f4be966efe86e2dfc0fdbe63a79f349959e550f6dc56993f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8a045ecd1b9404c95edcda6084393cbe

SHA1
87ccf5d05d55bc24347c2c4be3d7e38a982bb5e5

SHA256
066565e6a509ca933719a52927589f15d8e067b9f43410266661395ac4b647f6

SHA512
48f1e27859b3e5bc232e103b3ffddb3a72710560c0296be8930c8bfee5092711441b4b29af88f1f42b453e16d63a5c9a898a785953cbb5a77182a7b58b9fa1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b3fc649487c953af65f774c186fba8c

SHA1
017d1ed9c7558685307d2d564d797f8ca6e83f63

SHA256
9e4b44751ee1d59ec80cd06fca9afa14e14d467e9cbcd1eac59d0f48485c2da8

SHA512
043c3e434739214ae7f5ec5d22e3b218e5511a68678ed770fc0cb7739bf65940768327f2167b854d4d91e9b8505ff5d4020b139c83458328469363c0c03c41e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c479.TMP

Filesize
1KB

MD5
a9b9ac1794b36a106a5ba89d446f195b

SHA1
4f51b95a61a9b42bc072426f6019f77c8f86dd99

SHA256
3d018b30bb298e1a00c57f1a7be86a8f2f94951fd5dc27afaa13058b46fe2e38

SHA512
46786240489798978d8abd2679ed6b3d453d88758b21721cf2923458f14e406990e64464adb1e69ae31a310f9b4071498307f603e018de7c4b79b53eec054475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a70e506611c908a29600ec4f9952e82

SHA1
f836ed469dc9e76fd5606efffa9a17144166f179

SHA256
234171b892f2b9ca5c9baca1b9e550a5c2a944bb78a49f50791376c63359e385

SHA512
9df9bbd1972687c6484707d502dc7c7c9a46740b3e079c8fb57012f799325519cd9efe42cd3fec22f075f0857536d36c463745cd5afb2430118bc64efc0c3a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2450ecc0323626a7fe9d77909e548c2e

SHA1
d2e7dc98bd8de450c78988fa6d221d9622684638

SHA256
29b28ce04a14bfb87c46788083a0fd9010974c0435c8b4d71e72d513218dfcdd

SHA512
cd00bdf30dc72e362faa2275b00f17ff75842f9b1c2a4c04abb86558b9806dd7426e0bfb77e1ace6cac20be74d91ae1d954a3f09a47f6f757de4198c2e4ed19e

Download Submit
C:\Users\Admin\Downloads\DesktopPuzzle.zip

Filesize
121KB

MD5
6ec216cae1f0e898635d296bbb1a7539

SHA1
8725949a62c581e4c55d7338dcf3f67997840278

SHA256
431b9b7321f734a3f11b23e638199ff1f0d9abe9374ec299484d9e47f20b4ee2

SHA512
b619a5e8ccc0473d99453108085b1678a75dc816bbeb1d5301cd265ff8aee18e214d4e7b877d0d5d13921238d45581cb89021c4dbfb9ba2f3bddb4d4f297ddfe

Download Submit
C:\Users\Admin\Downloads\DesktopPuzzle.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
\??\pipe\LOCAL\crashpad_3980_OFHYPGBKKZCJWFPA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2160-566-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2160-569-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2160-567-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-579-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-580-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-581-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-582-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-583-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-585-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download