hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
93	1284	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	Brontok.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
92	raw.githubusercontent.com
93	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 733861.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
5204	msedge.exe
5204	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5204 wrote to memory of 5168	5204	msedge.exe	87
PID 5204 wrote to memory of 5168	5204	msedge.exe	87
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 4600	5204	msedge.exe	88
PID 5204 wrote to memory of 1284	5204	msedge.exe	89
PID 5204 wrote to memory of 1284	5204	msedge.exe	89
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90
PID 5204 wrote to memory of 1120	5204	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe02d46f8,0x7fffe02d4708,0x7fffe02d4718
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7922442698360147657,10528781845818404040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2896

C:\Users\Admin\Downloads\Brontok.exe
"C:\Users\Admin\Downloads\Brontok.exe"
1⤵
- Executes dropped EXE
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab283f88362e9716dd5c324319272528

SHA1
84cebc7951a84d497b2c1017095c2c572e3648c4

SHA256
61e4aa4614e645255c6db977ea7da1c7997f9676d8b8c3aaab616710d9186ab2

SHA512
66dff3b6c654c91b05f92b7661985391f29763cf757cc4b869bce5d1047af9fb29bbe37c4097ddcfa021331c16dd7e96321d7c5236729be29f74853818ec1484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fffde59525dd5af902ac449748484b15

SHA1
243968c68b819f03d15b48fc92029bf11e21bedc

SHA256
26bc5e85dd325466a27394e860cac7bef264e287e5a75a20ea54eec96abd0762

SHA512
f246854e8ed0f88ca43f89cf497b90383e05ffa107496b4c346f070f6e9bbf1d9dc1bdcc28cad6b5c7810e3ba39f27d549061b3b413a7c0dd49faacae68cd645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14998e2f-45f3-4648-9954-da390c29e0fa.tmp

Filesize
5KB

MD5
f65de5973d184f9acce6f506e23cecd4

SHA1
d575f3ce09e6adbe1fb3dfcd89f715dfb100ef0f

SHA256
0bdb28b7a1deb77c7e684fada54d0bedf23c61f00516067b0d94d0240ebbe859

SHA512
26be699061eb7ece9718dc3bbfb820d339680a164e1328fc1de183f9bd2a76986fe0a168474535aecc40b068fb23454429aef21fa3365b9e682931c89eb5ab52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
df2f71a6e71ecb7b6c05aefe04b8b2a5

SHA1
198b9077e9dbf559c9d08cb4e26ff4354c945efd

SHA256
34a270a0c4c76a5a13d19ff2f74929e5e37dbec690a9467250a82f2a278968d9

SHA512
4ecc112eb09b7e0cac1644c23e60041681daeb1009b090537193033b1efba6e9b1006679d76e920f624a7d50b825b236aaa91b646ba5a2c0d9e32173bf22a74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
0170c30b0f125bede7f88c82edc2b0af

SHA1
f6e5afbb5d657f6882b0e285c0cdfeee31c24d76

SHA256
aa9109d46652bfd48f41db8cc18992144b90580d93b2d111f0c6b5954ad71311

SHA512
02b0a5fb22290cd840a416139235128afdea2d612c1266a2813c0e122ba18bd398f3b8bc04f4cf789d5b3a68b26f957c34fa31746c916557f40260c819b42b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
70cc8a3949c227756b1f24e254545743

SHA1
4b4a8e7d7020f59bab04591705e35ffcf0d9aea1

SHA256
91d3c546acfa85429b7e802ad7c066ac1696dfc5ee7f5d2e23cf83a0f2183c3b

SHA512
2967ffd1433b56b4e684ab82820c009c9b3994d87144eb1d3b4328595bd778043924717c44e71f06e44fb2f200ed3a86f0d93115cbf240fa04d8050fbf1118de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b82102f8fee5a0a25154980afd5dd20e

SHA1
a65c7d71e2c3f13327c6c2459c25fe026df33b18

SHA256
c2681fc5cf3b4ec7c5a87a6e7262fcf726bc6d6889d96187929a81693ca64871

SHA512
6ff5736f037f539a5eaad7390c0fc063f865ff33eedc2ff7125fe45764249695dec7104db10fee8d5ac0499ddf8fa150d592d4c7bcdb30f883f0d47a5b24ca42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
2bd662a77ad13cde7c2f88689d9906dd

SHA1
fa63ca26ffdfd43bb3d31074d633e160e9a06425

SHA256
3833802b3606b04423d460673919f24eac81a1f3a5416a66b75dab3ce1a78398

SHA512
31cac3628257733d3ca528c2e1b042e3cfb84a7262d23d462514b5bae56ecf82b64d82cd92c1bc3128c83e7e491107d7ba26da786839253ae4df6dec8fca91b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
19eda466212ea25ec5933ec00c0b8416

SHA1
c933a1fe1f45a033df0f4d870c25d067f0432712

SHA256
648f68cd82805b7d3deec6b5989eca52590eec082e696806eb1b967cd66d8284

SHA512
864c169c824970239154a859ae919cc270d7abf375d118ddc345f9a3d52e3a6121de3f5becd003e0a3880657abf8e1b324d95133deb6e916c07a60aceed0b5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
041bb20f9ff26e7f3457fbc5a6fa539f

SHA1
4acdc6eb75dd0147131b33f8255aa7249daaf9c7

SHA256
2327fdaed70c04c53e83a59064e74b8ca976716d70786511b260d0c046344d74

SHA512
d72c6457bfabe73b395ab6e2853f5834725416a397d268d93107f0131375dd099e88b8ff30b31a574496ff3a5efadad28f657ab4464d2242f1840bea379e0dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5802e9.TMP

Filesize
874B

MD5
8ce8876412b57182b65aaa8528e7d82c

SHA1
21c6a53d4911c13cb63a7f833a893ea556ba661d

SHA256
85f119dffb4ee33a3175b22906de0d24ca1b9a6250fceac5f3e503c562c4efbc

SHA512
7831ba5586bf197f56d4806015ec1645040fb9f4ca5cb023bb5f00fce871cd311edbcb5990b198c6ab266266d05d02fd4c0d0f25f714216d6d9aa801c6e8c938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19112c4af8a51fe370bf6e0f7d5004d9

SHA1
1845e796c46eead28f31bb18e6066e46f7111ee7

SHA256
08163dbd77ffad49cd9d28f60f8437a95ddaa60cdd12bcbd1e35bb89c6026e9b

SHA512
95ef53e7f6aa447d4370977764bb806e07fb3dff6487e89a41ad1948357c6387eec7f9c2d869c4a2d069531de29b6787ccc22ee7decc2ad27a05fba5ae33e9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4fe8118ec29dfd880183fec38ce7a086

SHA1
37993123d66a01939a0179aa5415116cccab403e

SHA256
15000e6f2f7dc6c4021ec484fdb5d6878e793e52104bf14f76e68559b168ed0c

SHA512
832c8b42e047e83892cc0d1e37b1776bab63d12b2cf67342fba4c5b97dac0a847b687ca871045de0f64a2094ff3360f7a8f65bf21db143e65396ae52edf49960

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 733861.crdownload

Filesize
106KB

MD5
d7506150617460e34645025f1ca2c74b

SHA1
5e7d5daf73a72473795d591f831e8a2054947668

SHA256
941ebf1dc12321bbe430994a55f6e22a1b83cea2fa7d281484ea2dab06353112

SHA512
69e0bd07a8bdbfe066593cdd81acd530b3d12b21e637c1af511b8fee447831b8d822065c5a74a477fe6590962ceff8d64d83ae9c41efd930636921d4d6567f6f

Download Submit
memory/3024-293-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download