hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

21-11-2024 08:59

241121-kx44aazrhv 3

21-11-2024 08:54

241121-kt7d8svncp 10

21-11-2024 08:52

241121-kspsssvnbj 3

21-11-2024 08:49

241121-kq1saazrdw 3

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ScreenScrew.exeHydra.exeHydra.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4048	msedge.exe
4048	msedge.exe
3932	msedge.exe
3932	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe
1640	msedge.exe
1640	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3932 wrote to memory of 868	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 868	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 3544	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 4048	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 4048	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2600	3932	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce38246f8,0x7ffce3824708,0x7ffce3824718
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4977379144346811824,14072502552228541434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5464 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2968

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3736

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe"
1⤵
PID:3704

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:736

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd7e1bdad50d1bee313df522bebce71d

SHA1
37be20c3faef89e48d104cf57e6defc98622077c

SHA256
a23468724b98dc429684b5d6267bc3594e22a82b7d28636cc384679bee5ec1df

SHA512
c062c7607a68d8edcf4130b85dcf164718cc5d275056ab038a2004497f93596730c5d9390fcb04386d759f6d7fb47237cbefd28fe20a8e4f0b5d2c89848ab60e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
986bb379da214dfb99a36e580b201811

SHA1
f9ae21229915155499efbee262111ceba50a73c8

SHA256
4a912448c0241f56ff36fd8642fbf110e63c7d2e9aab650bff232b0a04ae114d

SHA512
7487f2220f2814ad19d30fcca3c1a88c21fbff9159393078c34c1747a2fb20628c759c887432402cfe43c55d7449181a117064bafd5e11f70fe63be9de1c17ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b35347e02881e8ddf2091d7c87139021

SHA1
c63a2c563dc61106b6dd4636f4684560eeefff57

SHA256
d52df51cd1a6b19440dec79c858c97f9b36faeb782ae3bcff6968fa2230243a7

SHA512
90eefba86ed9d15fb63d3cb2af7ed498652ce8b2263615f4c3f3782c32d05779080c1a2219a6ac642df43a9ade7df8023868bba97e3687db25d2caa807e55daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0db5e8cb8e7edbb69c75b32c7829e20

SHA1
26ca52fd307682c56588393461a45ee7c55172ac

SHA256
595864fbb55568f676e51f41e68c2ca96f9fc4634bc38da37d03f7b4295b02ff

SHA512
b51a0416c967d8e86ebd9fe58afd81c66548ea3ceaf57467c1f78812fab2e8324c3cf3f363518caa380fcdc110f2df6434762349b2414a9ea19c978cfe6f2320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25403171f544e98bbe37fc3d459f54a3

SHA1
5301f7fd11b90894104def0e3a018552d466b7da

SHA256
52de6f502a57aa7d658e064d44d1532668ab5388805923a0f03074a482ef36ef

SHA512
a2da8cc5527d9cc97a44f5099e28452767646b6573b29532abb85ab407fd7aff9bffd798e949ad9a9d4c68e2e4a3b1c3d142aa4e9102573f9c9e72130d56fac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa670048a1fe9b6d90d44b0b37f4e928

SHA1
0f25cee33422dfb18f38858d47438ab28eb9605b

SHA256
e8482e30d20d224c474ffeb1505f7974a2ab14d1481909aa22caab8780363374

SHA512
a85197217d542a9ea4e09a75d1cded61220f24e6300f0594692fb77af71d4043943b89ca675c4245caeb9797513ddc9abd910b867ad793db92ea001a75cceedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b4a0ead8df507f91a4a6dd3d6bb8aab

SHA1
2fbc3363266b86c705bc68106499635f21c56907

SHA256
2ae5ca4b4c01c0670966a2533e2ba641d8166d484d1556d702fe902244f3ec1b

SHA512
31754eac7f38bc409b0cd86e8fd9194b5a8ae05d6a513c1af9f32d0cc181601952f98bf0a99f92659aa2fc93a56a29ab8dfb4a3ce6ae7e51f89e25e97582530b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7433a52412e3f2242526709280813cad

SHA1
654f64576ec1cb13f60edaac5daf6c833223e59b

SHA256
2dfd3cc21bf2cc663984d337c46573fefe2fdc63f3324903a06bf461c630847a

SHA512
11feea197bf0353f4ff84822dc3a744517db9b68dbaae3dab8a3b669998b03d714d01612c73bd1856ed979c2f922d89cff27c280e45b0e6d8b620b11dc8bbff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e436.TMP

Filesize
1KB

MD5
b9580d0887ac7a46e413005ac0a93b6e

SHA1
99517bf13c11eeb54ca98d6f04e1fe7360f82740

SHA256
2ae5b73332a131aba835ce205d9c8575e788c86505348d6f930d9857ad5b23cf

SHA512
7ece769be3b81e0b458be1fd7b75aff99484ed9cd59e7db7460fa444affdd9fe5816a508fa6be3140536aeb4e57d4eb3ba732757a2476f54c284d61e134d0574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b483516da200686a28c86c0282d050e

SHA1
35bcf8677d26c8438fea8b77505e3fe8b42e97e1

SHA256
e245cf189dadefca1118f201c6afe4872cabfd6f21cbd2a5c6830b8a80c63674

SHA512
231098c2f3e7c24d96a4c2bfc666d9eccfe9e898cf52d592031313e190096f9d661a32d66abd6681fc0f510ca97e60200e5b961f26a40c408e7ac7d8a38bb2ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f6de9c28be5d2e762d9ac61a524ca35

SHA1
8b767218d06125170b2c05ac38c04096410de847

SHA256
72ee8a57b30a82e8e85592136bb7e7b07c399261c9d2b0728712bb3f24e5eecb

SHA512
607c86f18b79b6b122218d186cf98318a9424c26997fe66fe5d32b3e0e585a4faf2f933378f86eef1fee4819d18d8b347ec8827de6c5e0492dafdd6261933c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a98116bf53d70a98756563814fe3f51c

SHA1
774e226f71ee8d89a82d6b58febe4aafcf6c6d75

SHA256
e47946eb3e6ab61ccbb45179562a1fcd42af1bf891c570430d64c56da723e38a

SHA512
a4d44db3120e2d9756afb5967a74ec2871930dd0462fc9bfe7f3b892202a0c2d297ea7c2e74a5ee8d709b739945d60bb169ed8b4d2714eaa0d610b60b81fa56d

Download Submit
memory/736-314-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/736-313-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/736-312-0x0000000005470000-0x0000000005A14000-memory.dmp

Filesize
5.6MB

Download
memory/736-311-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/3704-305-0x000000001C650000-0x000000001C6EC000-memory.dmp

Filesize
624KB

Download
memory/3704-307-0x000000001C8F0000-0x000000001C93C000-memory.dmp

Filesize
304KB

Download
memory/3704-306-0x00000000014F0000-0x00000000014F8000-memory.dmp

Filesize
32KB

Download
memory/3704-304-0x000000001C0E0000-0x000000001C5AE000-memory.dmp

Filesize
4.8MB

Download
memory/3704-303-0x000000001BB60000-0x000000001BC06000-memory.dmp

Filesize
664KB

Download
memory/3736-268-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download