hxxps://github[.]com/enginestein/Virus-Collection/tree/main/Windows/Binaries/Ransomware/GoldenEye

Resubmissions

01/03/2025, 12:05

250301-n9ewpszxft 10

01/03/2025, 12:02

01/03/2025, 12:00

01/03/2025, 11:57

01/03/2025, 11:54

01/03/2025, 11:51

01/03/2025, 11:48

01/03/2025, 11:46

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
01/03/2025, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection/tree/main/Windows/Binaries/Ransomware/GoldenEye

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
33	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Paypal.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WindowsXPHorrorEdition.txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WindowsXPHorrorEdition (1).txt:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1432	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
2916	msedge.exe
2916	msedge.exe
1316	identity_helper.exe
1316	identity_helper.exe
332	msedge.exe
332	msedge.exe
3940	msedge.exe
3940	msedge.exe
4416	msedge.exe
4416	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3592	2916	msedge.exe	78
PID 2916 wrote to memory of 3592	2916	msedge.exe	78
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 872	2916	msedge.exe	79
PID 2916 wrote to memory of 408	2916	msedge.exe	80
PID 2916 wrote to memory of 408	2916	msedge.exe	80
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81
PID 2916 wrote to memory of 1032	2916	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/enginestein/Virus-Collection/tree/main/Windows/Binaries/Ransomware/GoldenEye
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0c6d3cb8,0x7ffd0c6d3cc8,0x7ffd0c6d3cd8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\WindowsXPHorrorEdition.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\WindowsXPHorrorEdition (1).txt
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7668147730447721799,7021333103543973111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=904 /prefetch:1
  2⤵
  PID:332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8baaf6c583536c9e6327e9d4fddb4cc

SHA1
0c1436d1a870038a6cb0195704658ef59ef78906

SHA256
7cea1717ca57c727378be31a2046e1b4be05ceaff81e76d45b5b3fb1a0b09507

SHA512
6cdb5d74ebf3c2f398c2032e6047f32b342db6f28f997c9c3df2351e307b316a6d66127a3ba6f0b1a721e5afd50a5578ec9835ea25708fcd49850ec4ba64dd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5332d65d7c50eee952b71eda55782f27

SHA1
9039a05b96d6f5fc532a4ddb304ec01aa2fe5879

SHA256
b677f0eeb2f0c049f48cc35d484ead2ba5434a74e4264e64d7f426fe45f2ff0e

SHA512
eeff99092be3b0bcf81e9ba0f2a72d592938ef90952e533f903707d1e0af2138db62a4b491476f499a0909bf52fc7aada7aa832c73aa882d40f488afe5b29b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f9551642874a40d94c73d73c254ff334

SHA1
5893d002cf7984f470afbfe8b5b0a04c3df4a13f

SHA256
69a8be4e7ffc62aae84139a3d83bba91a2055c56c6cf726edfb71a3087b4047d

SHA512
2456f61229cce3e620b8a5ec3267b47f5df46a075fb7e428b98ee609bc1df88889f31c5f5b5d9ecf51954c9ced9030b2d8a075a45d2b045df1ae76535b82b4d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
7b2253a6fa7b6c941784b92704186809

SHA1
eef99141df17a30e851e15a88373ad50438a1180

SHA256
602fb72bf192a45033d30ad0518344b2f7c173894ff70934259944aab1bf7c88

SHA512
0772930a8d2aaa2f1d2bc65f93de20f65c26145f18ac567f15714a467c203726bade5252a906f40231bda84ce1f663d517a062528de0b0f94df8da358a5892b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d73ed56ed2a141b92c8787fb5182af0

SHA1
a5dc5bb82fa4cb8babdaa7e5ca9749c621779ef0

SHA256
14cc2a80ec55d5d73d98908a2a3ba523a24c31518d3665a33a4b1b1a8840fe1a

SHA512
5f6f762f28727311053eb134dbb6c97cf40c8646493a3e6c2bd5453140bff347efa82b3bfa5c28631845622a6779c4285fe4136a86b7102a6d3779199497af74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e61f8af2947a94092851b8f8c7257808

SHA1
a4756f5db446cef5201626d5cefda459e6bd3ab9

SHA256
56d2dc712e6e68f2058c11bb0a3a5a62ffd18e3f99c3c092951bc3dfc4b63aae

SHA512
4c7ef74e9592754f7a3984f92cf0c3e6e675b22d9489ecb0cc7e43c27884f76d5a9a0a99df76efa73be9bb2dbdc8f9bac5163598f650afb5a8294ea92d193786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a614a82e2a89f166df0557a1b2494ab4

SHA1
e5dd880c842e36bd017900e4751ef506b202f265

SHA256
38c8f7a3c4fdfe359f8b1ccbf687467cdb6f8fcd830c2b4f7ec15154f84eebaf

SHA512
7204f0644f325e1c97743ffea850be3d9a80a90273335fe0a5d7a197fc8340f7a1290284248d58cf2081547769056351d73b92868f6b746be28c97820c1f9838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4363e0211f40ae8129eca88974e5d1b7

SHA1
a5240cf8d5a09146ae0cd89c373eee56016bb21b

SHA256
72776a429cd31206e0dd915338b364a2881ac46d1ec54eb7f4c77b49497bde0a

SHA512
3715898fe66083a672769ada9a2854e046944f11a5261faa610b7612bb9c9b6d4aa47bd9a8ce86ec51a97220b9adb17897776a7b7268fd2c234a6fd301c53012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6debb48d00284d01633fec18995f3c94

SHA1
1d1ed1a1075a8d40bc493c897ff4670f27ca479d

SHA256
59af911deb61d2c9e0b1a798e81c4fbacdc14adb03489eb07832e3c2e934f694

SHA512
f4e694ddbdf33f1f0df22eb65b0aa7bcc248f5566968c3533ff49e343532584a0c2dc83992e50e9700360d1c7d12a57f83cc0b95e1c4487764e95a89030816f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7279ab766bdbb188bb98e25bbcea7d0c

SHA1
2cfebc9d2461bb5f49cad5628394200cc3b300de

SHA256
319f427bf768eb85640334d3aa00da1c53cd98b4db5a5eef4b3b578a0aa53b67

SHA512
795a08dbe84602e982e1cec6a5904d2fd078813939a744f3631c4395465d1320d8b730715bff7acd1e5c9371400d90d85d3489286391dc98226ff50d716c6381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1544ee09112b6fa97b56d4237261d84a

SHA1
ac73da3d5fbdb6489ad92aafaf72a40a7f7e9b56

SHA256
1eefc799b81894a2b6fa591593207f9aaae267c9fb3fbe930c51d8abcea1ea57

SHA512
d6df8ce035d2d19d69ea90315f6eebebaa5e1159a313e981f0cc67264a482a3be05bdbcdd97124061f4f989f2cdd2c047005ce97238f9b90ddacab59236f71a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
31e2af8eb33c5453bbb9f3e3b0aae5a6

SHA1
e147366a6feade45f82ee2c5606ca97f67f6a8d3

SHA256
dd2b074eb4fd244edd378d2c050212880cfaa0bb82d91c00438e612f25b48df1

SHA512
f0a62533645c0f54722108cfcd70189fa0ee0fb09e65c23f86c7018145b0a51f3df82caff2b2de94b29baf67ada99f2fb44d3ec7107b73671baf92350caf7658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34949464c874e6f447c978ed92ffe296

SHA1
dde600ed8fe1363015cc2cd5340f29899f0eb7e2

SHA256
38a4d0d5b8aa7fe00d3992bac26c1ab57a247dafd58764e157635d4aa57470d8

SHA512
667644efacc84d03b710e4db3967152bc0c645611ab85b2269f1a61db52f93260b1514e3f3c1266ad5fb35bcd30c32edd82555390107884dc35e9b0f572c2c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0dc2f927b7f8b4baa5d6a85c0691c6a7

SHA1
cbd30efe4cf7003c0c8a909012c56967efeb0da8

SHA256
0a17d6fc20d6d3c61858645a8ad77893d02c28a6f860e6121c5c3608753d56c8

SHA512
b9e8b82e33358c44a1c9fbafdda0bbd35dd0c8bb188025ae6e8e2eab042a96b949bba2000e6efb7e6540886f044492ebad141539bfc789e19676e237f8d6ddf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f40f8301d64fd7372ffe73b9716482b3

SHA1
9bbab558ebf598c0868d0898efc8926d7c027ec5

SHA256
4d8ba67631ed858ae229946690e0aeb52877ad33286f48be8c48b97dbe180fd2

SHA512
086f072a7e265fece4c7a514d9e2193763fdee17ca98032f66b2f81cd9f3a5a210aafa8679ceadf1073c32ceefb9829d22b7f319f75d3efb9431cf0eb57a0acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
fc50f97b5443c7b4927ea942df16d317

SHA1
3262c9b937453250d2a9eb1a0378194170b255c8

SHA256
7eebe39607111f4bd36dfdc37a31f293276be9932f8871e6130f3936b2cdf0e5

SHA512
00e07b62ef180443034d1bf60862f12e9bcb25df718689c8df3f9972b46477d6d286fb5375e67a39306f1573a1ed48daa2c345da9bbcb2904f88f76b8d1e6a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
30e2a884e84476e7ac18ff362beb3b2b

SHA1
fa896b84c7c4c5a4c835b9c08cf364c3e937391e

SHA256
32479402148880f3678547530829ecd8a0bcf5b2586824a32b2a5f61af8b5aaf

SHA512
49845735b60136fbe2cbc04ec72a4e45f6e8e0ad502324ad8e36be46c7bbfef53e7473a3f15c9a5cdc9f9f5743c9213013e6edf163369f7ae34fd1f9f89fe4c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e24.TMP

Filesize
874B

MD5
a4e0ec54b5390fb223668bd09f3a7b24

SHA1
950ca610819109b5f6f8a8ba930e3c499c4bf5c9

SHA256
99fa7479665852cf19c45bca65fa879cba6cb47cdbc3e1786c66cf4887395c78

SHA512
e33f500a850d8e4cc965601915fde4bc277cc8c1d82b5d6ba2d3936bd42a27f75e497221b126f2d645bae27167274fc860678fd4682ef065f503efcf3595fe01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a69600717a1e0761aedf798ac64fd78e

SHA1
e28cc1d90c9ea3ff35f25e0a2c59e28074958651

SHA256
2f56ef2fc67388b88778dac993b3005280a6c29ecd93f1d6be2d3bf377e73dc9

SHA512
a65cb350fdc819d28a543b21627cdb6e9b74d9cdb349bb3d3e9998bcfc9e041beef2004b0e8da0d4edfd3c26bc6c81adac752bf5babdce9ae79372f7c6374a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
66655485e4794917c8222cd0b70a4427

SHA1
00b6dac2501d5b92a8f8ffec895127664c46b2c1

SHA256
1f83b5f0d360e16610eb9e02edf6592e565b276c99b835e205298ef048722405

SHA512
265b957878939344330e44b4cdf5214a9b5eb7de25cdaa993ce5387e229b02a468c1067692db7080d31a2cf4cec923d7aed835f4ce7402965a445c4ccda6c3bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
218081a57426efabac8ae3788285f154

SHA1
0dbc8cc96b93d6582e0b7de79d9892e521483a47

SHA256
08a0d1ae10be955f3c97fb0cc407d24065ec60551e91ed31dcb73cf677ab3072

SHA512
37ea819f146f45337f1803f329964d342e4f93a312a50f431e89cd722df5283a316a78febcd7cd7c153982301f92a77a83f03de6bf9b3be19601a87aaecb81a2

Download Submit
C:\Users\Admin\Downloads\Paypal.zip

Filesize
3.0MB

MD5
6eed178386859ac9b3ae49d3dcec297c

SHA1
4e41a6375459adea394dc3ff8ec5f8fa189bf236

SHA256
3e5ac22cc012f4db06e208f26782f682fa97afc7250d4a472ceee9c6ed50bfe2

SHA512
345bf7cc25b364b67c809dbe124aeeee0e7c83db8d9627af1a1b9a06a737c5f6ecb49d80ef710a14d63b5283f1af7ac3b02a8dfd8e36fc25d715051429225890

Download Submit
C:\Users\Admin\Downloads\Paypal.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\WindowsXPHorrorEdition.txt

Filesize
123B

MD5
49f5ddbf0748e69f30a2909276418311

SHA1
c3205cccffe909f2a60560d6179cc096d4907386

SHA256
1e9637fc91b1fe4a13401c4bbb1919f0fc951c55b8d120df51854df02f8fcd6d

SHA512
dc741df9988212c362315d82a686dc0b4085890cdccce98bda8ec617a671b737f954b4530a424816cf5fb3affe3355022b1b1acae16fbd7dea33adac7cec80c8

Download Submit