hxxps://github[.]com/Astrxadev/Blank-grabber

Analysis

max time kernel
53s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Astrxadev/Blank-grabber

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
68	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
976	msedge.exe
976	msedge.exe
3736	identity_helper.exe
3736	identity_helper.exe
1160	msedge.exe
1160	msedge.exe
4920	7zFM.exe
4920	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4920	7zFM.exe
Token: 35	4920	7zFM.exe
Token: SeSecurityPrivilege	4920	7zFM.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
4920	7zFM.exe
4920	7zFM.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3624	976	msedge.exe	85
PID 976 wrote to memory of 3624	976	msedge.exe	85
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 1616	976	msedge.exe	88
PID 976 wrote to memory of 5036	976	msedge.exe	86
PID 976 wrote to memory of 5036	976	msedge.exe	86
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87
PID 976 wrote to memory of 3800	976	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Astrxadev/Blank-grabber
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff8c6c046f8,0x7ff8c6c04708,0x7ff8c6c04718
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,14646782244273185510,1628186282424233973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Blank-Grabber-main.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO83383BD7\Builder.bat" "
    3⤵
    PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55dd91ca-900a-4cb7-869a-b8e12646e1fa.tmp

Filesize
10KB

MD5
f511af704abf820914c1f8caa926d274

SHA1
049bc839ea232f6db640daa41bfb83420e93da6d

SHA256
e0ff335e39e077ec0691ad6cd1edff1b58f3463caa5a70a82e30e9397463fdcf

SHA512
8f5cc742dbe4f60aa7a86e4af78b8f20eccdb30c6d0806ec8859896d67fe2e81f027a1001dd27328e53cf974eeaf7357268226de38c6e6dd53b76ed182a030da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2363cae1-13b1-4bcf-a6fe-b5a492e6ce58.tmp

Filesize
5KB

MD5
848885b548f69557abbc0062e8fd8eb2

SHA1
eafcf43de09261c1806c834b9f4b906e2aba702f

SHA256
b0a5a927c742d4dd8952e2bdd44048d800f6ee09325e8e928853c24c46f23626

SHA512
efbfe1df8e88e68c5f521621e6b28d5a4f6e18c1c85681b652d61eb5fc088f96f3e7544f7996469523d1fd8f338779b0264ebc6f4bec0d296cc292c932dae95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ff166a832d37818f5f75e5462c21f81e

SHA1
b7d6eee9eead6ccd172a1ac60f63537d3c051d72

SHA256
06f3a8379124a68ab5af0b0a1e8313833dd9f26a395038895f77a6b0b2347f3a

SHA512
fa3f209328eb0f7daa1ca9bef1d21996675dce88536c36d4ab53c1705c8f49d10c2c325c7e869e98db31c5cff9b6a1fd3e1dd17ab20f67fe24a46cd55fdc52d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f4363c8ba03a90f2a2a6d4ee6178828

SHA1
5b67cdfc893ae25a6892e8482164783371e87c7d

SHA256
53abaac7169265e21e8fb3a3ff0f7a3335109b3a8057414da4aa2de87a16e734

SHA512
fdf642b441affcfe7b1d2a5ee8484cd6d723e0a625b50dd99a79ee7f38a07e4647b0d08765ebd8ff7f6fd7f154bfc80c34a12df7763fa25049b7212714e459b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb42421c998f1e377a606435a99f5847

SHA1
51ceec340b3d2576a631a980c961040b80dee4de

SHA256
b3865096a75acc780f2b37ea7eade59220ee35b86b89a654c6ce570bee0e0d5f

SHA512
f763494f7aef82f86839bf9f93f2667b4eb094ba28b95cc3ec910164ac49c75e5cb8137e2f61aaf0e0011daaf8831e453b68affa498a8b82c6f91c48402ad0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a591f5924aaf69e077a4082605afc3f

SHA1
d81015af3704821f28cc851c5db54ac94a52902c

SHA256
cbac49381cd07875fa4d4733ba741772dabcbeb32a65078d84d1de27e216eae6

SHA512
3eda839b6e53f67c9d83741099e4cddfcbba8e1e87cb97861e6c5ee5d5798c89c68f16aea30d1dbdc2df3eb885e0265b57cd38a79f1e6b381b454c69546a7b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2767a38c3a958a03c480e7fe813e13f1

SHA1
de38037a34d7fc3f639a6487d46044682fc0ccf5

SHA256
f1af4ceaacc067fb3cd8a972ac74887b75801e0547666fb47939e1c43c6b3090

SHA512
45c94966c2efa539422a54766fcc331f915ab6a820831680a6c93a5dbd3160c57f0c1cb8758bd880087c6f59560f3e4b41c4c3c48183c039121eca9bb0b725a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
027599812208cbbe811fdc4033a7ec73

SHA1
824ae7dce13ecea12fae28f57bb6b0b2c5742a8e

SHA256
cca8fc53a7d4e28bd230c6ea4e672c1bb52040a3417232589bcadd4fa0f50ac1

SHA512
6368b7af526a1a8193135f1fec7e49ef036fd84196cbecdf0e1bb9997368d596c98767949b0b1cf4a04ad9999818a2e006086b86632a1dafd5343c7c5583b931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a7b9.TMP

Filesize
874B

MD5
681dd90a69c3e9cd60d56ce176b7013c

SHA1
7757967fbfc5de5b30a77cd8a81e69f41ddeb1b6

SHA256
f7d5359b207970c428ddb22575639ee6f609769fce33f5478e4d76830f8f7dfd

SHA512
9972c5dfb646a8e0c30af85bade8aae994937659599b100b68c95582d10af50376d24048b0e40ca8c5ea88dc388a1d78695c0983940ddb667a02804d0c4d3a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea14683d23783aa040a29a024950443e

SHA1
637c5a59f50f6b303f18eff636fff6201e3de9fd

SHA256
79aa314d913061aaec2a6b9a73b1eefa0c63e7593bd66e2e0c7f4b5b692f8736

SHA512
27545be5f681394b53599e9ee22a780c1690a4e12d2283b9ad642da8974a03f9181980c6f68e81472a8c47df5602e282bf4e0d4a7caeb9595c86cb854c1a29a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38a0e038bf6df5f12aff83088013010d

SHA1
3fb142df22966f86e4c1ce23ef161e88a49f8c68

SHA256
4969978432a6ad6c519cb67dc455c800939f82f2ff5fc88fcaae96f74d5c1ae9

SHA512
843955827412f70498c4b865f9981745e20da31b2ade566fe5fd5205bcf3806c20d36263de286f8a19b1b77f81562fa3666eb2f2394b6bd3708608f3665dd510

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO83383BD7\Builder.bat

Filesize
1KB

MD5
9012ff1161e2fe332fe93978a73217ff

SHA1
f638a4b300ea2fb5ce95ef718e15d00b1b11c71e

SHA256
3e291d969706e9f1d1179156c8fb76ca03b32a6c106a00a80c721fc2af8c1083

SHA512
b6868442ca39171f404326796a1b16d2ea3852537983a617786fddcfe8e2a326dee6ee022b30e80899c02b76d701aa68bd9806a967aac428528db7104ab38676

Download Submit
C:\Users\Admin\Downloads\Blank-Grabber-main.rar

Filesize
10.4MB

MD5
de8245717f781555d88bb2040fa217eb

SHA1
c1a09ef59a2fca050155bbde323878672e4032f6

SHA256
2092f08a2ccc7143436d0d1151ca84826e5047305a16947d099345737c498975

SHA512
182c734c966a068701b4ee55833957952ee7d96288bc82360103f764390cb3afa238f376eb9720be43c2dc4d618a01fd97448d296e936b0ed77e22e4ddc320b5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 55317.crdownload

Filesize
24.3MB

MD5
ca9d29dee3de0d07b2b0b18a2d70adf6

SHA1
21b8df7ccfef2dfb27a90f0cdb2a0241a483ec09

SHA256
61a8ddfbbf6841090987e56f58d68224b48702fe69da6ced5008ac55e781ace4

SHA512
090a6894465b8908a1ab7962b68e6becb4a3a8172339cf16c58f8685d35fb4c1c500b2ca8796c00172e6e35c6ec30e0bc40224640f60f5bc10f9917f3cd90178

Download Submit