hxxps://github[.]com/sapphirecheats/sapphire-lite-clicker

Analysis

max time kernel
130s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/sapphirecheats/sapphire-lite-clicker

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1636	Sapphire.LITE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
39	discord.com
40	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280069375-290121026-380765049-1000\{774D2568-61A6-470C-92E7-4ACACE5460DD}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 244133.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Sapphire.LITE.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
5112	msedge.exe
5112	msedge.exe
4764	msedge.exe
4764	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
444	msedge.exe
444	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1636	Sapphire.LITE.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1700	5112	msedge.exe	79
PID 5112 wrote to memory of 1700	5112	msedge.exe	79
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 4612	5112	msedge.exe	80
PID 5112 wrote to memory of 2016	5112	msedge.exe	81
PID 5112 wrote to memory of 2016	5112	msedge.exe	81
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82
PID 5112 wrote to memory of 248	5112	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/sapphirecheats/sapphire-lite-clicker
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffb6c13cb8,0x7fffb6c13cc8,0x7fffb6c13cd8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Users\Admin\Downloads\Sapphire.LITE.exe
  "C:\Users\Admin\Downloads\Sapphire.LITE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.sapphire.ac/
    3⤵
    PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffb6c13cb8,0x7fffb6c13cc8,0x7fffb6c13cd8
      4⤵
      PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,10730207464163434552,5541907407644594252,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0407c5de270b9ae0ceee6cb9b61bbf1

SHA1
fb2bb8184c1b8e680bf873e5537e1260f057751e

SHA256
a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

SHA512
65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ded21ddc295846e2b00e1fd766c807db

SHA1
497eb7c9c09cb2a247b4a3663ce808869872b410

SHA256
26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

SHA512
ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
6e68b51f7a9aaf873e79bf41944b30f7

SHA1
cfd9ce16968d0ed46d57701e777322bec1f542d4

SHA256
1d30198b1eb294f7bc036599b3a809ddc49b8c8ec854732c1dd842809c5a5c27

SHA512
8ff199a510952ba0cadeaf94ba0a71d805d98018ab5d2f460ce3e5389bbe57072cf50b9ef36e4484bbd4053bb5b7684db5b0dbd30a6fab0598ae63edead63564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b15b2e0e60f73e64744f8ae664e1a845

SHA1
376cd69625c81f28784bd1c654a12f30d865aee2

SHA256
8c9d69fe365973f43a473175c7967d70a5acfc2bf81fd08bafed36e980a8d3c1

SHA512
786c65189fee2812d5b87a90f2bb8d5a8ff6fe4354dbee81ed286244ab662b369d68660de18daabeed57d8caf00733ec9b9f682e01117be0e84923e9a4154351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
34a72154ed9746a609b29d25ad8d6469

SHA1
ee1fc6413972b90af4973bc1c158c47011e757b5

SHA256
629a1e55ae58d7e9e13caf2aabc58ad73415b514df679a5e15ac561b1b549f10

SHA512
2789dcc6843a73666ed06d51a7bfb8e92dd7c0a82062dc0d252d883e4c943fc229932fdb1410e9d40d7a7dd965623f3df582640a0952adf7feb7e05a68e37d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
718B

MD5
b0111c66651180664572d29d0200f400

SHA1
51ab34078f5811d4a22fb8bd015a4709bc19c31a

SHA256
6862fd49c7cff532e20409cf50ce5de21f1abb1261b60d57a33b38e88eb44dc5

SHA512
178e5770f26a5118936a86e8418c9e728077e76e97603c07ed1f5f0d7c0ea5a21d696efbf6ffbb792b6019380d222bb723ce6bc1d62fd8948ef199805a6ecf3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e4135b61db962c9a52e5c68e99e8a85

SHA1
8da3eb4d0a39534504da3535d516ed8855ce99d1

SHA256
442f2bb13b3cfdffc961eb02ba14c1cb36b7a62eedb4c7292f09b511d7e1947f

SHA512
b7e04b5f592be1e2adc74d5b0b019e0692bcc3bb491e49de0b1248f84818ec0b7e02e3e48fd7012b54a6c3f05a19debbcd596ff005a42592b35bf409fb11ba78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fcfac1121ab9392c598f79f9efc137e9

SHA1
a83ecb76bedefc945a06ba79823da8ceae81c921

SHA256
b26dfb0974fb8f512a91399de39d72be4280a7f91209b014f2fa4beeda3d1ddf

SHA512
f64bbae7cf221a0e9508f536e28d2e882b56e9e5b8a84e8cd9bd8684856def466c6102f7e052d3c1e4adcfbdfdefa04894d414f89d41506b05092d3798d1c35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2dff423beebfd1975bb44309c34ed9ca

SHA1
b7ae7a8eefeaf8c054d5600daecb0f4b7987b679

SHA256
79cd0c64455c48ed5878fe1a24714e262aac64cc7b42058ec55271d75d05a970

SHA512
ae6e581f4895f494f7c57375f45bd8627555ae3982d81dba749dc30aee1c1c14177331edf11c40ba3bb42d604db2f7c02a57176a32ef3ccffb0858311fb5cbcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d101a1424fafde83f49c462a9e35f18

SHA1
f2e2610bfd202356f8b6ef246601068d7347350f

SHA256
91d21390a31f61734fa34b3162684674753c896839448cca3ff6bb752b22dd66

SHA512
a123e43f974acc695dc7c93b7387eb9811ef6b345cc9812b0ec0a93e8c44fa54254365ca41a28f51728933a1b9d6686173d26559905de0332bd8e893517b07a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
814993eb2b4016fb2ca6ff00bf83375b

SHA1
7f1ed4fd5f26f16715c6f871fad19e67f38ab4a6

SHA256
d90a47ff27bb3005b11d8de9beb7a675582ec8b43ce23f756be67701240717f2

SHA512
625705eda452707ff38b6fbba88feb9b3a6745421b2df061cf55271bda7e5ded7455663a3ec26950b1b4382b024ad1e031a30c18dc16a1c416b9b7af6e29320c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c4f.TMP

Filesize
874B

MD5
e36683855991310d666881ba5d329618

SHA1
8150b9635c6ea68c69dc0d0c75f455eaf1688f0a

SHA256
c4c79c9e7a73b534bce36599e3451d5dcf0f06aa26e345c204e816fd78dac1f6

SHA512
2f5b3885dc1d945061c7254bc3d4a5f801cef0355db0cbd83aa4eb682dadcce5228bea4885db692577a7934b2c19e7eafff0ae26c3ad2cf1c0f8858fa660ffe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd736900e942fa9cbd971aec4e597cf5

SHA1
fff20ee1c783e969f41b8aadeb9ef1d8bb1f72bf

SHA256
85c10e6247396e6c40d54cd735b1c7ffb084085d906e7b85f79171570e7a7172

SHA512
38c582df9f59b53ac10a14f3c7116ab4a298a950f9005a030fa0b9c37a9326e9cdd7d9faf7a02db635c4eeb88321b496f208968d6b741cf43884a402b24ea08e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
60284c0b81f5a373f2d2102913149054

SHA1
273777d9140585a37c15772eb9e277267ed234de

SHA256
9cad19cdfedc543b3428faef6fa3545c5136e01cea43b9a5f5c1b1fcde647ff3

SHA512
c9300658efd6d0909f56e9682ba01912468c5a86c448d098f1a6855c3631dd68a4389b2ffde588af3b564dfdeffa61d086a0f51bd922ccd274afdf49c435f411

Download Submit
C:\Users\Admin\Downloads\Sapphire.LITE.exe:Zone.Identifier

Filesize
116B

MD5
c0a5a13465aa43982ebef9d3b4db0cf9

SHA1
6afd9585d5a2f91c8e6ece26fcaab2821de76768

SHA256
fc8a9df0f2684731e12cd3042f9d1d11cf2ede65570958da8f2592132278a397

SHA512
c73a4fb9b06c76b3bd870500b3323c58c11b2eaf5457a4e52b1fbe153fd5c4eb2e878f889f97894e84c79cdb8259e1910ffc0e7a3ac0585a73d0359a7d9a3444

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 244133.crdownload

Filesize
1.2MB

MD5
1bbca3b8649901b50e00f8c0eca6482c

SHA1
398b31f87642bb25fd10be8f8936d0d8664e40a9

SHA256
26f5b4590ff9ca791118130b05363b3ad7a438c60cbc032fc812098943640976

SHA512
53ff755b549eff97802dcb91c193217db635c109b0be445d98f0e3deee1ff0a543b04f9e6690a45f0103a3523e033c2af9568454ea071b25940493530435c970

Download Submit
memory/1636-267-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-263-0x00007FFFA25B0000-0x00007FFFA3072000-memory.dmp

Filesize
10.8MB

Download
memory/1636-268-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-262-0x0000018477670000-0x00000184777F2000-memory.dmp

Filesize
1.5MB

Download
memory/1636-261-0x000001845CEF0000-0x000001845D028000-memory.dmp

Filesize
1.2MB

Download
memory/1636-266-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-264-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-265-0x000001845EC00000-0x000001845EC32000-memory.dmp

Filesize
200KB

Download
memory/1636-597-0x00007FFFA25B0000-0x00007FFFA3072000-memory.dmp

Filesize
10.8MB

Download
memory/1636-598-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-599-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-600-0x0000018477660000-0x0000018477670000-memory.dmp

Filesize
64KB

Download
memory/1636-602-0x00007FFFA25B0000-0x00007FFFA3072000-memory.dmp

Filesize
10.8MB

Download