hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

24-02-2024 23:16

240224-29fd5ahd4w 10

24-02-2024 22:21

24-02-2024 22:06

24-02-2024 22:03

24-02-2024 21:54

24-02-2024 21:50

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4356	msedge.exe
4356	msedge.exe
888	msedge.exe
888	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
5236	msedge.exe
5236	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 888 wrote to memory of 4972	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4972	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4980	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4356	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4356	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3520	888	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe24a146f8,0x7ffe24a14708,0x7ffe24a14718
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
2⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5196 /prefetch:8
2⤵
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12220142795251601105,10086495266612722956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
91746379e314b064719e43e3422d0388

SHA1
65f1a2b5a93922d589142a6edf99b5b35d986dba

SHA256
0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7

SHA512
a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ccf8b7b618672b2da2775b890d06c7af

SHA1
83717bc0ff28b8775a1360ef02882be22e4a5263

SHA256
ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420

SHA512
eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\616c0e8a-c419-4f9e-a89c-3c1ceaf2e34e.tmp
Filesize
6KB

MD5
636f57e0a7aea3476ba306e0d40c1a31

SHA1
020ff720a073fcb42ab193612f36fdd1758d8dd5

SHA256
496be326ebd57ba889428acfe8113290f9ce081288b151a10db33407247dd8bd

SHA512
8b3873290cf04761d7f6b0a45350fc29d18947d6291aeb5baa87126c5aa0ecf5b00b5aa9603c60138f7ddf11e9ec96c95714e88de3795fce69a7d19ea652c2fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
b5b2427d3a8d924d14ca1bedc6c24968

SHA1
de030688706a2ffad6516c4633f9c81fab4375cb

SHA256
62e5ad759f02d44e8da891ecfc0534c443442ec9da978fe48ed923fcf90ac3fa

SHA512
1d7a07ff26886f92e360ca9db2b9dea7eedd44b18f20321c8b57245f3b6f96a5aa610b8d30f543a12983cc1c847e8de7b9bd5c83f784c2a4bb697664387b625e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
573B

MD5
a6d346f58cbec0a6e4015327b25f1537

SHA1
750056e65a8b1c20b1a6051f5adcdf35821a6ac1

SHA256
1a715b1b5b62ef83ca8c62a18eddb3b5b6b738be2c654ab7a38cf22fdc8bea56

SHA512
74e563217a28cd6427739731f51ba2e35ee060c8ae6959d458d06a0416e17ffc6a49f8d0bbcb8d17cef144a45c36eb9f3b92305389ab0cfc5043f530d9f28d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2b5f5e3c04a0a073a15e36514140646c

SHA1
ef7c3d55b006c04b493453a1d7b2d42bd949fd7a

SHA256
a60a2d7f34ec522efd6193b136237b0eecfd09372c6e582648bc84a44ca4dae7

SHA512
94860f516260304b83f1f67270950ec4225a1bad04d39e5c6851d746896c18be29de3fb7c442e27857ccb438f5b90d2799ea5dcd9623e0d08f9ff859d0bf4cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
026e07731f53503545605c6b8d5662c1

SHA1
a131e3fae090cd297e55f8698822e135650beb86

SHA256
348f7e0074eda68d309d48311dec2fda5c1cea0f17e9efe3b5100036808a0400

SHA512
abac33610b13b6bfd4b7ab1e5d52e8a5c5a83370b68734525d23a49f5e14c457bb03d5ad8cdef3d9ceff765a8f0f07e67d2c6c48f771a3eacec6530df3535555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
4e1b6c7d8f214a575d0792822b900486

SHA1
fb5432cfb617bb625e60589382b748ecd2528cfb

SHA256
2e57670cf4e18b6379d88f4895453e01e1197c08ef1b5fb09dd08af7bb4d992c

SHA512
23c89727b78ad5a97c8396e25d7ba6d582bdc0356295e8c5d32c04fae056354769a39f1284943a00aa38de9104eff1567b4e2192c103137593e4817b6ee4385a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c1e8.TMP
Filesize
874B

MD5
67afa2a8fcdb67ae6f63fc735be02df0

SHA1
e07ad64fc8311515c15cf2103a6bcd9a52a4272d

SHA256
904dc360c72bbfa5f1404f524f9d607783fa88a0f97a3f207cd46fabc06e0798

SHA512
ee544a6b93161226ea196a45be2d356c2059803080bfa40256b4ac6e38c5e2c2adc2505ecbec728e38eaf00bf0f1a5708c39c5018d71ab6838e104e6b2d25af8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
57536db90d45c6d11477b6cf4452d16c

SHA1
dbb83e715aa59dbaec3e14449d44404bfc5c9fc4

SHA256
491c636e029fcc6bd9afa807c4dffccab622b95fa917d9e009507fb0f6103a05

SHA512
6e1ae3cfff21e969e17b271fa67049b7b94f52a5d5b96b346caf427e11cc27f7a212d7e0338a72f1bc2c68658a5198d2f6c36e24c921bda129a7277a327edf21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
0fa43cb834cfbd10fe3f59f96f4548e0

SHA1
7d6642592532d217b25e4bdd75b0c8b98c74cad7

SHA256
bbba059dac2bf097ca2dd5f3dfbbba301ce3d1c718bce5892c73e9ae1b803fcc

SHA512
097059337e21a4308a9e9861e07b3a5d02c1828d7b377672761219b5b3b5d9dc88c09641162643c22b840a89228269a2512827038b71a4cd170ba8ad00485dce

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip
Filesize
384KB

MD5
e3c0650da6233c4841e6f03a8fafa418

SHA1
c461d12d2f072d7c839f60a210869c76b541d870

SHA256
0c966130ee722ee412023c22b763d6b1dda8796796d53125450ab831cfea34e7

SHA512
e611ddc3de5604fac070bd1b7e31b4b647da366bff09fcd468710e2e1e72ad908a5731197ba24008c67a733ba388a27638c2be9e20807ae784bc75b1e16626ba

Download Submit
\??\pipe\LOCAL\crashpad_888_QAVOGHRBZWYGKIGR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit