hxxps://github[.]com/maze147/blank-grabber-

Analysis

max time kernel
564s
max time network
572s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/maze147/blank-grabber-

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
63	raw.githubusercontent.com
64	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
2376	msedge.exe
2376	msedge.exe
2308	identity_helper.exe
2308	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4976	2376	msedge.exe	83
PID 2376 wrote to memory of 4976	2376	msedge.exe	83
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 3004	2376	msedge.exe	86
PID 2376 wrote to memory of 880	2376	msedge.exe	85
PID 2376 wrote to memory of 880	2376	msedge.exe	85
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84
PID 2376 wrote to memory of 1696	2376	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/maze147/blank-grabber-
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff437646f8,0x7fff43764708,0x7fff43764718
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17447236288201210456,7624554541137059616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main 2023\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9aa5694cbcc824c94087943dc42c10c5

SHA1
7fa0baaf7ec4622273275c366260bab955db7971

SHA256
f451da553f3529b99b1d4aa4870346d96edec6a0230cecd902057eb71428fa0d

SHA512
69b005907c181d0d160619337e902d79929369569b5d5f2b5bb720eca9f6537e6b3366ef73db28eb7a12e8e3a4120cbb039495b4f4b1aa7e5c3b22f894127105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
678B

MD5
6b622a1795b3a4544a7f1ab7b56acb1c

SHA1
65397505aff8e3606f4518040fc73532b047813d

SHA256
50a2c4a8f406d46b5c5d563ff1fcf2e28a5ed5380548fcd7879dcb3ab3a8217a

SHA512
f36746c0d178bf784843a0da3ce167d8d10397c3fe468df801f1c13450d3ac610aa9953ea2a8fd7f1d46cc9cc547a8bfbb43933ed0e937060a27135e65f3cbac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83ef38491ba047b947ee42338ae01211

SHA1
e2cd17105bb38a9a7978867d645215ff4d3147c6

SHA256
c030fe91e270db148d5c308c8574699e5b24add2deddd80ce4a80790a33fe696

SHA512
bdbf13b3d620e7b474c7c0c169de57f50f4b984de2af80f94de5236e2aebb0e9ac5736feb2aaea22a91f8caf1514a95690d57f365cfadb487d2a350bd9e237b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5999cab0009224be2272b758619abb97

SHA1
645c8d762aa0c574692fcccc8ac24e3d3036eaf7

SHA256
21cd596f46eec6100af5b3d83332778fcb8e73c15f0ffac59a46f2a76b42d8ad

SHA512
4b005e4c777b7c26e68e3d85617dcb531db8d1bac1a095ec0f47e5e1958c101a7e3b18348cf81a836db18a5c5f76dfb6dfc050cb0c40d6ed32d74ce7b1a6bcd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1c239930ad378dc7af71509d989e73b

SHA1
0a38b24f4cc883ba91282c12a078f8101dd758b6

SHA256
5e709fdbe95236fb6504d2975df76e7b6499379e4699b1b1b12688df2e4c5e6f

SHA512
1f80969496546e357336ec5d1d95c333002304298c79a64434ec77d347b14590eeaf032cedabf5554e97e545c03d346fc4967b24f482b71f8340be84461bbfa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f95b0ce7d5709577ace8b7b3290dc4f3

SHA1
0e25ea66f949b7ea8d7921a5e832476fc44bf262

SHA256
241a617fb1fa37a2e030419d2dc9f185fc6966e072d537a5b11df93e495ce476

SHA512
a23a6c74e74fc21ac76a650fb3131daee3ba9f1c9b1ff2ab50c309be0a6231cc68b28549f6b6eacf91aecfd804441999b3f0d1adfcf1e985d0dd893c8525aad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b7f6.TMP

Filesize
1KB

MD5
333f2506245035e1bea7b6be730deb78

SHA1
3d8906a0f20e9833733f6579a074a76857043c2a

SHA256
be9feaba50d698c53c66ee14b05de88fc4e43750907fada4371743bea5343010

SHA512
f87fe57da20b27e9f4c0c0c452f0350425ec798bcbf0e49c554e0c9f1bade2a78cf097542940309acbab6528ae8287fa6e1a7cd992de0a39dd4429e7794ae6d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0955dad5caeee977d96b8294c5300b23

SHA1
6b579c50bfa9d61a431602adab959755744e03d6

SHA256
b5df001978e00e4881a5f430e90088ba6ff3cabef185acdad38130b8f7ea0314

SHA512
1aaec7fb52a5d39a7c964e10a7152af22d2147065832a3a75fd25ea96eaf5461579e39a5eba7ed094b3d0ada7ea250156fdaf68246157a5854a937836bac633d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1b758a1aad1d94dc82dd9ae293c201c2

SHA1
b35912c36f2ee75f968d494cee42095bcb17ac1e

SHA256
40a57b6b9e1fc67cdfeef04aeef085ff252a8279905f4767da12710c1b9740ba

SHA512
fcd742c7c5f2bce83c8f15fad3307190ead86b3629a0045ccb57a3f8572513439e2c345b1c984a4e443fe38be6bfe9251b1aa5c0da614e9bec82e51e4948f592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36cd520a8f9bfe9c2fc36064d2026666

SHA1
2aa08729c0b29178f51782dcadc10ae4f8b9835a

SHA256
178787c0671c6645b6681fc12bf01c74ebe19322b1efbe53a3531d60c8dc7988

SHA512
6e3880e0c8bf1301b5614dfaf03e40f04011e685de93da81bd99e89ba27f559d1cfd266d249df9eddf04f6242c1c2c0d4f7de6d7b12e30823a1eaf6405d26f1c

Download Submit
C:\Users\Admin\Downloads\Blank-Grabber-main 2023.zip

Filesize
2.7MB

MD5
ec6f1d7504554bb4ca6bdbeeb8662a8e

SHA1
153c73cfd10ff80ca5536dcfb9e8f82d0c6983e9

SHA256
d38de2e05fd478b0eccddc3baf884284291a8b472db4752d229cba9b6c3aaa92

SHA512
fa43a8fd5c867aecfbee7a632cef857660b86d2932e6c13ab8a46179070fa243a7be2cd3389631b3bc89065b0f341ed2cf0c5217a0f3906a97aac0079899a658

Download Submit