hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

24-03-2024 15:28

240324-swvgfsde24 6

24-03-2024 14:02

240324-rchswadb29 10

Analysis

max time kernel
69s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
38	camo.githubusercontent.com
44	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2948	msedge.exe
2948	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3248	2948	msedge.exe	85
PID 2948 wrote to memory of 3248	2948	msedge.exe	85
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 3156	2948	msedge.exe	89
PID 2948 wrote to memory of 2276	2948	msedge.exe	90
PID 2948 wrote to memory of 2276	2948	msedge.exe	90
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91
PID 2948 wrote to memory of 4964	2948	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4ead46f8,0x7ffd4ead4708,0x7ffd4ead4718
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6737241817769951263,3745027927673849562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a4540fd-ae63-4360-9f75-462587e72e5e.tmp

Filesize
6KB

MD5
c37c85cd37363d85ea24deee7a11893e

SHA1
37312b381b23b40d57d4eb5acd605be1d18acd12

SHA256
ea25452d6ad514ff5cb302c4118ac282e006f2818ef23d59ea8c2eaeb9b79578

SHA512
32c070e1fb4d4ac7f927a9469055f51874b86b78e89b132b14af80d0f0648c64242b5b62bbbe651812e05af370f39c57a163ffb263598bcd548568617abae7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ef0b05c70d3540ba4228cbdf3a4432ad

SHA1
ec6a3558fe83c6c15847ca347c34eb2ef0b1a7bd

SHA256
493bcd8b8cd0d075dc6cf08a7bf6579924d8323cf47a4c3614ba7ce99ea6b179

SHA512
854d8aebf396f22219bd473e6d48fe517833915a37ba394c6322e81391e877d628766dc61734ab68f73638e46cf00714b3133c87907caf39bcce9c3bace1709a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11bb1488e951968991c9848c024e2b58

SHA1
44fe4bed2dd97d569a4668f00054d560753b18ab

SHA256
3c42257ad2f236095cdd9cdb914c230d9fac456535d1318774467e1167d42e27

SHA512
f1bc1dfd453e15fd63d7ad8866e02d0a2b4691c3dc87e892e1b1918334ad4a06ec953b60d56b5880015a965c9b5f2a04779606298404fcc73e74a8a61ea391e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
baafb7e2251a2bae59995808e6b6090a

SHA1
6e0d0843deed8a1587813d6d68acb268eb2864fe

SHA256
7051d2a783f894ac496548d436e7007f788fef8adf74c9dca4c17b4c1eec4dbb

SHA512
39fb150357e269a9c04c8c4f98211dd9b8ae3755a06b51d3cfa807539aac44b3d201f9cea5d221ef09a4326b033ff5f54a05e751cd5fcf401f8d63a4fe9306b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b21ba12d6adc9fc5a920da7e323d16a

SHA1
2fb29dcba0f50076875c0b6514c3ca1b5f4c4e68

SHA256
99a35c1ebc0d44448990db05508003e46510f444e4237a8f031f8ec85ab713e6

SHA512
dae1a72dbb8223297b15d49269a9c3fd6edf82dcb18976d8921317598a41485918668d06446246a172a6938c4d5f4c46ecec2a0bf2fb4c6004125ce8640e001d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6e07d843a167fd7408dddbe7293b120

SHA1
8c2c800184e319c31728e90fa1207a765f150355

SHA256
e32337e0d5feb6ad8cf7c3dc982500133c4c76d745a96e0a00f900866233e3fb

SHA512
4db55a8a05a7dd9c5377dd8fb6998ec73e159ba01b1ca4088c856fafc80945e94dcb1535cfe0164ccae915da659dfd7e4a792aab038dc974066e5f87cf6881c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f03c.TMP

Filesize
1KB

MD5
4ba29f8d1881855bcd5a43a99c1cea71

SHA1
2c477e777150858dc70e4c09d958774bce556160

SHA256
7b4a451e352dd074995d51c250f2f06a673f7dd395e396d9fd4ea638f4984748

SHA512
17ea02697de0e81c74bc3b190f392496600f2be80118363ca54401744c64e8667949ac49a34868096c0e386360994f8656a54f2bc67e1f77d163679dd5a7f7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba64284e-6402-4f37-bfb9-0b62f05f3b1f.tmp

Filesize
6KB

MD5
bffe0cb085dc62c657ab9aa1e2094b68

SHA1
6f70e8fa4ae147ed23956c02b766319f3ea0c8e1

SHA256
b1ce576e989a3b79f9b2989c716e8f96aacef56706580d60be1ce481c0a6bc27

SHA512
b57202ba93e4cccb9a0b4e04eefc8f4f115a2f5f3a97358f731cf6441ba0a99312cabe4d893bc58d633806303f4cf93945cb35e7f4b6f7dfbd2637125703b441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f36b56d627e01734350469e34f7c5681

SHA1
f12c086614dda23fb376a96c4c63bae089eff257

SHA256
9301713ae65cd36ed10395f18755efd959cc3fa9cdb0a8009c1d55e86d4835fa

SHA512
76c0282caba33f45b2e21bb465e831e75a27946939cbfe28157cf9f95a88f1d508afcf7187fb2efd135b91a1e323f27832c22647353255c8a9775c34581e5326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c70038ef918ffe452c8cb49f971f6a30

SHA1
33491c90c5a6ba23a54fb5738390021a249c232d

SHA256
33b8a2f67764a56327d3f7128a676d35e4d2f096c1c6fadeed252cca7e54c85d

SHA512
ff32cf6f3a95be3a25d100f1f94222b59e1ecb55fb5b75f68fbb68d69553a2712e6915a9e85ec516fae36027f7aa5e113a3b1d1f71137bcbd6121f782198da0d

Download Submit