hxxps://github[.]com/ytisf/theZoo

Resubmissions

23-04-2024 22:06

240423-1z3agacd59 6

23-04-2024 19:46

23-04-2024 19:42

23-04-2024 19:38

23-04-2024 17:41

23-04-2024 17:35

23-04-2024 17:34

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ytisf/theZoo

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

Processes:

flow	ioc
42	raw.githubusercontent.com
37	camo.githubusercontent.com
38	camo.githubusercontent.com
39	camo.githubusercontent.com
40	camo.githubusercontent.com
41	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4632	msedge.exe
4632	msedge.exe
4664	msedge.exe
4664	msedge.exe
3996	identity_helper.exe
3996	identity_helper.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4664 wrote to memory of 2928	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2928	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4000	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4632	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4632	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 2668	4664	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ytisf/theZoo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9142646f8,0x7ff914264708,0x7ff914264718
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4117491879289470731,15783741657294645553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a46637f-38e7-444a-ba0f-e4b6babe2f52.tmp

Filesize
657B

MD5
6c4ec35e44ea6d76c1610d6acbbbd13f

SHA1
84b450cd2df2608e92608b78e0eb58dc0f25299e

SHA256
4ed66e7f626d520e7b9e5364178ee37d4a536ce17059b9dd8114516b125e95fb

SHA512
f1faaaddd997525094ce9f95741105dfcaa1329f0defa6b6ea066db291965761577ddd8a2f4ca722e51b9deac47a09369bef13a68206bcc5094347dd86f05d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8862548d632155d62fe91ec9b687557a

SHA1
c66b9590d57aaf93141a244b2d794069d9d138f5

SHA256
4ddf83b2eeffc55ff237285dae293e4fd871ab2fea1523f26083022f6ee41cec

SHA512
743aa6478a0692187a81ed17034ecfcf1ebe0ebcf493e3b81c5db2ed8b806577421e45de1a641c48b3b3f187bc227f6fc9620602e20f3b6adbe12914c8b5c418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6be1e139ae592c778a35b8a34eb5399a

SHA1
7193453f93c791c9880c25edfd826080d1ba6f9e

SHA256
2f9a132f5acafa3bd8c586256de4c915156f92abb80aed09a5eec4821ee0b13b

SHA512
37b5d4b4dc04db3fdb8df05be2e60deb9fcd933fd53938b8fa3db3f49c002e90c7c58633b45711ac61eb7b4399c5ce215a2765e648320b62ca672f43a9ce15bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0beda9376121500ded61afd8345aba5

SHA1
29bf512682c4992aaf3c3f504d136d1fe90a72c2

SHA256
188a325d4c199dc4b604c00e3666ff82a9c49c583058119eb9eb281d9ee94611

SHA512
61933daa28dc2e623d35d379dc2c43bf37f70cef70353d5268d3cef979f1c0c3d50d5a2d782f5f2fcf4b9cf7565541ed9510a1e10e8e6ebb85f0dd9b24f3aeb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dea8e712a0f9aae04031fd3c43952d27

SHA1
225482601a230756c6bda19a1499bd60646fb6f7

SHA256
a14b7ebc53f39d6e6c7a1e0c59466c08e47ad9fc0420bd8f2b6dbfb5126178d2

SHA512
4b2e0c8e048755d7ebdc97f4ebad1fdef6d1c24eedc861e08cdc48820470ccbcbc3abed1f9de4d5280f7e0eb2e3f4ac56bc4fe58390c0d3b62fdeb3776177341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d183b26a010baddbef94b9a26e01ad7e

SHA1
dad3ee03c952c2292cf550380de509f74772b1c1

SHA256
e8be06c7f6a7bfc7566d6dd3502367a831b3103a53924f6aebddc2c9fa0a804b

SHA512
863cb5e6aa836d6d03547e226f451f4f38c1c916c741f9d30496e02509e9051ea25eda8d49ae472c7404232f825007adc20cc1ecf82141b25955d67e6bf2a100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57802c.TMP

Filesize
1KB

MD5
f78c812901fc0a24f0c459b09f1e5e10

SHA1
6ec6ad9117f82fab5578b699844f8a6ca2a66449

SHA256
3e62c6c37cc4eaa9c3b24a48c94a57ce7a3c79684abf50f8280e5bdde7fd3d50

SHA512
a666ba3a8422232dcba62498fe1c875732d112c60e8abd6608fb92d41abb192dc8db6200151de56ff89d1d5a77feb88e06cedcc9f43388c61545650cf1f37f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed243e468d6605ddbbad472e48134d95

SHA1
38196d6d8f65baff8d3e980dcb3732ff96580cd5

SHA256
f2f8da4028f227e2d2a5a5d5363f6748bf872144ea3c42288ac38bda94301b96

SHA512
ed6efb39d88facf7a1f6de3f6fdb12080f020d870a2b8470f668ef0f36ac1da1ef34e143be9324c2ddd3700fa10ad072704df820970c7357b028c1687424064d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
282a8ba039e0c24bdf6971bd1e6f0f1b

SHA1
0c43f09251ec1b767b9c5a06a9df8e04c672c093

SHA256
9d0847e9c04972b4140f79682454f704c4bb05437bebe794202f7cf5c5d3b734

SHA512
8c39d69937a04b3ca133937e8b8bde7493b4a0d104b2542823aab5ee6c08c7f4a6f309d65103c3ca7cee7f834daecbe21b463da79ca46bb03dc3d3feaaf2a172

Download Submit
\??\pipe\LOCAL\crashpad_4664_JLTFDRGKEMCSBPUK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit