hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

21-11-2024 08:59

241121-kx44aazrhv 3

21-11-2024 08:54

241121-kt7d8svncp 10

21-11-2024 08:52

241121-kspsssvnbj 3

21-11-2024 08:49

241121-kq1saazrdw 3

Analysis

max time kernel
120s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3020	msedge.exe
3020	msedge.exe
4400	msedge.exe
4400	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
2608	msedge.exe
2608	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4400 msedge.exe
4400 msedge.exe
4400 msedge.exe
4400 msedge.exe
4400 msedge.exe
4400 msedge.exe
4400 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4400 wrote to memory of 1396	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 1396	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 2372	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3020	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3020	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3196	4400	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67f346f8,0x7ffe67f34708,0x7ffe67f34718
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16357811068939421671,10495342690831615499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2464

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Melting.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Melting.exe"
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8bd3694e-8acb-488b-9915-9f71907bd413.tmp

Filesize
573B

MD5
29d5ccb9d97be7e71a805e020e215f5a

SHA1
ad0e558b2883de819f155b4dfca2233918c40001

SHA256
36a9bcb2d802fc0f3cc268d78b0c89af6382c476364c443de562df7cd3c88d97

SHA512
d3335b34a04146a35ee6b62519888226a22eefec7bd0c09cbfa2d2abf68e0f095c8c9941fbff96c51b7c25e0a804641303388049195d41e9a43590527e56a445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4051e82b132dbdf43e7bb9704bbb8372

SHA1
348998815785a036b81570a9bdfd0a9222ea0b7e

SHA256
4d6b76cf4fd6f1c3a946f5ff596acd1e934f20a4377e15244e889588261e4923

SHA512
eaaab437ab85f9bca5d45ea909f339806a2010f8d2b2d76f695f75ac1fe5907c2f7149336a9d4ccbac08cafe9f0569cbc7be0c8f771ca419234623de6cf76034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9fb7575e42f3d24a87d279645715ae5d

SHA1
9f856d6aff43c75b4724382761eb080dbd7859a7

SHA256
7b66dabbcbbf0ef3d4be740dadcd484cc3158b8050ef6810180722515c65d6f1

SHA512
32acaa3dc516bc565d68da21d80c6b60e262d59eb47c5e97ff8dcb6fa8f074ca5b6ffa8003ff67ac42e2942503806e219bbd736aa565b04d653a766fca53b857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db3d9f32ccd67d0c5acfe258877e0507

SHA1
6cb3a024ba89ba16fd86f2cd4ba10dca0cfd2c3c

SHA256
bdc1d810fde24924c31811ad1945c093f742a7f72a26392f62d97d2058de6ef9

SHA512
40626d03635c914e3785797a6356f258332b42b7b9ade78000ad13e142b05d35fec51f5b2e359cf822449e212d1236163cbb51691be5e6d6d8a00939ecb46e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fff2b562aa3b987e9999bba61618263

SHA1
26f22dc6ce98e19ab6d1b097056d0c7fd165993f

SHA256
42c6b10818ba753f57fa1e95397d155e4cf8434f5386fae2d35e3abc02257f4d

SHA512
7088bb8111981078e6a946633d53af7ae254bac4043e8dda680e70971892e0e8a3665db410f319de82a315ab85c2871bd4aa772cfd37618ca7f063570c922bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a76116c0b3a021f1af559236b998ef6d

SHA1
68f137d03831b5f7b1504d64e2a77ed0db6f6da9

SHA256
0379fc70bcebde6984164b486aa4f176e351d306840a1c335c3337bb1826d2e3

SHA512
a4659993675f14f9093871c7194067b6d80b5dd0e80431dfa84faba6615eae78cab8caa325e3efac44b078f82302e4f6070ff5ad34e768f4e831ad22470ed38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58051c.TMP

Filesize
874B

MD5
fdb911207532b3bf02501bb6fcc8c160

SHA1
c803d92a5c7cdb7a600783641b4039082c8906b6

SHA256
97f3d849f3ac2ae87da79122e44bebf518d1d071aa5460353af3ee51e8d69103

SHA512
76fea725b463f100d416892e928923b223e5b369e95c3339e5d310604c15415b8428e50897dbc623594f5e5a16944b159eb71315e0a3d03b67a72caa2f95d98a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1027081885a7a5b84814fd1a865a163b

SHA1
639b1a8156feb7d8d0d6da50f2399e12b5722235

SHA256
c801b574110f34fd24d64e4b2fc262c79cfc74883f13418eb8d714f71638b76e

SHA512
5bafd6e4be6bdcdbb93d1efaf00d22ab4bc54abe8f268393b3226f32e380f360d4c970c3ef985b7ec9e5444dbc374398b514582c35921df3de1a3549aca8b174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c606d27c166e0e9cbc41d2349c0b7cdb

SHA1
133a48203d6ff025a32a7830485b8dacd564b3cc

SHA256
4907bf2b1ff7d4697591be959acf783fb1142c38b35952e6f4446e953df51f22

SHA512
72439ba68216c9cc106a61509dc75868bbdefc47900d4df125a0676d3e6dc9858ce185f2d8f5991d1985797d8e65bddb2c51dfe263951e4fa951ff1502cfd6fc

Download Submit
\??\pipe\LOCAL\crashpad_4400_XYKOPDFSOQEPZTJU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit