hxxp://github[.]com

Resubmissions

02/08/2024, 22:55

240802-2v6b1aydja 6

02/08/2024, 22:32

02/08/2024, 22:31

02/08/2024, 22:20

02/08/2024, 22:13

Analysis

max time kernel
68s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://github.com

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
432	certutil.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
42	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "184"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 938396.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 546659.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1788	msedge.exe
1788	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe
220	msedge.exe
220	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4064	shutdown.exe
Token: SeRemoteShutdownPrivilege	4064	shutdown.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4836	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4112	1788	msedge.exe	81
PID 1788 wrote to memory of 4112	1788	msedge.exe	81
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 3076	1788	msedge.exe	83
PID 1788 wrote to memory of 1236	1788	msedge.exe	84
PID 1788 wrote to memory of 1236	1788	msedge.exe	84
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85
PID 1788 wrote to memory of 4584	1788	msedge.exe	85

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
884	attrib.exe
784	attrib.exe
4384	attrib.exe
64	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://github.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,13237901880378877758,12423801702462892363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\dw.2.bat" C:\Users\Admin\Downloads\dw.bat"
1⤵
PID:1168
- C:\Windows\system32\certutil.exe
  certutil.exe -f -decode "temp.~b64" "dw___.bat"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\dw___.bat" "
1⤵
PID:2792
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:autoexec.bat
  2⤵
  - Views/modifies file attributes
  PID:884
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:boot.ini
  2⤵
  - Views/modifies file attributes
  PID:784
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:ntldr
  2⤵
  - Views/modifies file attributes
  PID:4384
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:windowswin.ini
  2⤵
  - Views/modifies file attributes
  PID:64
- C:\Windows\system32\msg.exe
  msg * Why have you done this?
  2⤵
  PID:2016
- C:\Windows\system32\shutdown.exe
  shutdown -s -t 7 -c "Virus Detected, Shutting Down."
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4064

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3957055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
31addb95958094bd70e516d39274edac

SHA1
6e5af89059fc98395b7e76d117102268f4f63a71

SHA256
f41aaa37dd453ee132f28609fdd0b82b1d29fd869dc3629ec70d61280ccaf505

SHA512
bcc582752ef82144a3e25b32e6eeb64c51f90144fcdb5b33044b40e8c4685eed56184f9f958782cff93ddbc74db08fdb9a774901a9c993fc7ee2e23d9a0acb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a28fd5f0866fcdcca1c5092e41a408f7

SHA1
f189fe2d67a696eb0710d934bf07cb2b44fb965d

SHA256
1e38960968c688c78f13c67b51d2a68275909381ffe6a0105d97ccb558cd5237

SHA512
8882fdf27a8a5545c497f598af77ef152c9e994b42134522156fc2484abf173b2c2a13255820bace8254cb2ef0a9c69c8e7582060f6491e35997ddfdc81621fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe0a515a6c49a4f08763b2371cf85b46

SHA1
e8158e63e0751019ce4eeaa7ff97b6b092da3b36

SHA256
76a8fa6a290f093f5458790cb946558e80067a2c78462aca417db31655fb3a17

SHA512
e7bfca870b957128267448ec902537df2ef9552b72baa3b89a12f4bc13e3aec1bbc3846e8fb945f3726d796c14fd46f8b560e12fa59a67a0d4918c1d3a1c5aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16eac01191a5080473dccab0d171fcdd

SHA1
748089e6281b9835109d89101ede7022c7cdc91c

SHA256
3f5854c73d8f5ff132563c311da5f30641ec83abd1df938fc262d5242c12546c

SHA512
515f0e90a43c228a549bd3fffbbaaed48439dc3a4f8fef91e988559479a5f82880f04ef80e3df78b0b573646773f94e957531e2b188223e7482735fbf7c09ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba7ab1f68fcc26dce6103ee689eb409d

SHA1
52899a53544c6d82a1a20b56c1bc885c6558d2b2

SHA256
487c6d0574754c49d0926507718d6b283a9219325d8a40d83a97536ac4f5c6e5

SHA512
ed25b5c3933ba4a1a108b52a90c9a95f602e7e017d00ceaf906f64109ee21bd33b4a7142701b46446ba7c2217830a5982bbf7580dea873e7fad4677d3ad539bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d75eb666ab6571960accda5757edf1d

SHA1
e260f54d283e6426e799410c19a3d3bfa6a961db

SHA256
a1f23dc7dac4535b71a06702144eb7b2328fc5a76b35a486f80d49b4f234ed96

SHA512
3ecc5d560f5d34d9247b732be3a266af6edcc1331709f0670d967e42bcfe831864ce7c6695e22e7b292cba117eb166f4c1966c5bc4189be1b172cecd103abd60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8edfb71ad21f0f8f3871b63b1ead2a82

SHA1
1ed361ed0a986d4b18c395eae3f68c03d333dcdc

SHA256
3c03982a0d58f24f40d8614699753b1cc847fdbe9dd8302c82e76b2167c0c740

SHA512
b2a93288071f0be1c8fce2fce922f42a4f3547007397c1b150848d0c5a827d88fb52359590c13cc4c6d06fd47b579e404cf9241f945f4ad40bdca789cbc077bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
190d573aa8cfe3fa6a7a3dba17a884d4

SHA1
9622c0142825d56483bc34c115514c241b1c162e

SHA256
5bf9429ff1f7b13c481a792c0120e6749a4ff8665e9c5603396a07c29168fafd

SHA512
73b589d05b4a0064e276e9fe726d1d3698b95931420d7791cc4a0e2d07956331907971c3b15a9d2cd57150a816bfa3a5b37ab535994fe335532bbecb85b65315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d590.TMP

Filesize
706B

MD5
93aeef9ed9391b2b19fa69ae6a780e07

SHA1
7e6ec7b3a3984afd6c55bf7a19238ea1d911f90a

SHA256
dc1b8dd932d6cd17dabf31f81ec685dcb5be08d24068a52f4a32c1fc04221d54

SHA512
28d118fbb31bf0febb62fa6cb05699cb0f0c7e84b5ddc289f90a5365bf0b8b0f45a051ea53e7466914ef35c64416673c0f8cbbcd9e7183213e5a89584f20143c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
09d22d4541ec6c2bcd4433bf16de5b9a

SHA1
c2ee159e83ca191ba47918c396d955166838a9d1

SHA256
ae05c9d39acc300aec56a4d3c0213cdfc3f6c4a1b072eee2852afbffd4dad76f

SHA512
11e95543161c050c4494f4d52b80779b0e2f953b1dba6ff90889437ee570212de000c322eaba8764b8c1fd988b427d3c6f52c485869d4b1a48f034343e780ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
984c9295ca6c0d90337adbb68e643ffe

SHA1
125af1d51aefe56d05536cea2016d0234a06719b

SHA256
429c6b3d89e765f1b86d9698e4633380196dc202fca4c902e4e3fb4168566dae

SHA512
6b339ed2b13dfad8d4d45570cd40c02a5c132f7f6d7200ef8eece280ccdc35e291b65c7a9d566a293613d8e6650c31a7753a47e1a2690f528dbe4f949313bc6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 546659.crdownload

Filesize
330B

MD5
8e12765b70d3c038a48302793cce8329

SHA1
a90d4b96b3f250ade21627a401eb66763fac0135

SHA256
939cecf539eb89f0d63101e99c5bbdfc4cb6fd2aec13e7799955650ac67e63a2

SHA512
31e62054c930bba125c1ddd96b1ae1504e94f93e131ef6d43f0718de1c7479a022c606753b67fc7692dde20703f4ecc121911621f0a626987202f0337c4e826b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 938396.crdownload

Filesize
296B

MD5
2bef33a50313586b83cf8e1faa129688

SHA1
7863081c9933a44af5d2f1bbba726d5b5be31acb

SHA256
233dc6ad74a21661920117903a86d1b9688634de0c80ac75425baf228acb4478

SHA512
ee5cd1616f344f93cebc12c6324368d29b3dfd833a11af6999754a910ddd0a9b6fd5b7445395dbf8fd3703bf2d8a5ef363924b10a2f4594d8f3dd259e4fb021e

Download Submit
C:\Users\Admin\Downloads\dw___.bat

Filesize
8B

MD5
0d7dbd96fe6d0a5f0efb4f55e8561e8f

SHA1
839182cee3df6d5b2c989b4881b37d0a9c42f168

SHA256
996a89fd6bfbaeaa1136b801d32ba387187a89862f7f00b1d5a6777da372f4ac

SHA512
8fb3900ee7dd9d0196fe446426aa89997e4899ddb74f615b522b75100cd9970c73250126e6a1be83099be9bb1e9402149301ccd8e64bb2987a3a92cbe0f6ee6d

Download Submit
C:\Users\Admin\Downloads\dw___.bat

Filesize
304B

MD5
d76885370e55b8f2520463a847b98bdf

SHA1
305199a1d5394ed827cb802038a38aede5843437

SHA256
5417b43d7ab307436715cd300087137159d43ddba98e24848c6552febd7e0d48

SHA512
36a64e18be55095c17edc8fb873080eb057a7edd869077081590760d8cbe2bbbe5595761b081c90b22b4a413846c249b94ea9390fac82715a3dc7b4b55b43e06

Download Submit
C:\Users\Admin\Downloads\temp.~b64

Filesize
14B

MD5
816cae6f87c10747e73011e19198f2c8

SHA1
01d9f01b57367c29fc2f9ede2ec625187773cf2c

SHA256
82c8bdce355c14c90b32f8f4ad6def0cfd0b648e0e89b1657ce9436268c879a8

SHA512
1a56a58c7bfab0f358d079da4135d162417abdadf8a023c55753ab43cd7518136b9b10624f750c8a4b3f94ba41cbd65d348fb4573a441402f653b7e4cc09b537

Download Submit