hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

18/04/2024, 12:16

240418-pfngesea41 4

18/04/2024, 12:14

240418-pesprach82 1

18/04/2024, 11:52

240418-n1ymfscd52 8

18/04/2024, 11:48

240418-nys9ysdc7w 6

Analysis

max time kernel
104s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
18	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4092317236-2027488869-1227795436-1000\{4671B1AE-6D54-4B97-8FE0-52B6C5921163}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
4368	msedge.exe
4368	msedge.exe
520	identity_helper.exe
520	identity_helper.exe
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 5036	4368	msedge.exe	81
PID 4368 wrote to memory of 5036	4368	msedge.exe	81
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 2568	4368	msedge.exe	84
PID 4368 wrote to memory of 968	4368	msedge.exe	85
PID 4368 wrote to memory of 968	4368	msedge.exe	85
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86
PID 4368 wrote to memory of 3768	4368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfd5846f8,0x7ffdfd584708,0x7ffdfd584718
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4846693046599613485,3973666560668040698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f87e937bca59c014b0236c210d8dcf9f

SHA1
a03e7cf1472bbb96e1deb8dce3c879d79504a5c9

SHA256
2c85cc76a382bc28e9a9a4325391cb752af0115a4fb6e9169cc8b30162473552

SHA512
ae3c996c138b3191d7d0517bbc3411e930bea8c11401fdfcbf9570f6357d856dca1f4432ccbf155d17b61a3d72616a07fe5a5bc2371de4da24913554e177eaef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
703B

MD5
c81f7bface025c09d00b007ad800d986

SHA1
f0a637ec957fba115028533f007d48cc873d1b46

SHA256
a3065b147a0285e30292838c5f8aea0712b355269d0971484ee4241159716f52

SHA512
31f8f89298989762138ea830c1eb1ffb9d49ca5b3818e0f59c32caf1d139cf5b831e3a66d28e017c2a0189920d01da7da20de061dda18dc1db4a3e2bcb308078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55db14bea6733afe0486e98dd1a1f324

SHA1
e01efbbeaf138d5990da87a60cdbf9a125003927

SHA256
ebe1a46963b84b93fb0c436d021c9e9b5cd7657ec73508b1ebf2e622e067b5ad

SHA512
f50b133c8c5bc8cc61d29dae3a74a34d0f2074b7c35336960bbae3e1d103dd2a75789c63bc4b80d50d3307f17d8ca795f90c311b04467c9981c925840d7d8cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66b5a0713b974a15bbcdb8eab9c4352c

SHA1
f786bd5e583fd3872772fee7e1ea3d98babc56d4

SHA256
dc1e0ab26c9aa765ed7aba5565d39cdc95df3a89f4057522f5db42e090bf67ac

SHA512
682e6a322f7347e9662cefd063adeb9b915cf2c2fcaf5c0cbc30c1eafb272fe5241528ad8a9183a5eb4823e187a411e6a709d600f5b14b9d7f25116919c45702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd7d6b244aa61dc12af4c60398f915eb

SHA1
f00eec09690be65e54527558fec292ae5c4410d3

SHA256
5ed23506ec930c5eba0e1dbc19914bb26df74af9d2992a35cdd796dc2a38aa35

SHA512
059f88a33dba2b575f1452e0889d0ac49057c3e0f197bf5ce2b622c0102fab3f060553b19322de1d734ad349b6fba39835cacff5f167c6e3615c14d365310283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
90bfb0f38daec12f8c665abf4465a2f6

SHA1
3ba6776c78878fbf4c825449400b7f7f339baba6

SHA256
c5d672df51c459fe8621376b2813e0935fb8418ef2a863fe63cfadad78f46330

SHA512
a8269613e0dc203b4fa729f8495314d5813e1c019f66525053d9e9d4fb30fb07748314088d7b33064216fb0e79aa622fcf8c50641078d5f9a628fe0af077e3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6d74dd760a573d8b83ea386bf5ea749

SHA1
597599a262fed7243b796f620a467b697c46adf2

SHA256
f476dc4ad1d0cecc924f70cf01e815a2a454def15c463c201a5f10236353d846

SHA512
9b4ac94fbf17f464ffba5650e375c7fce7aaa23e47af2ba84af0335beb806c99b91e87ddeac7f7a51446e00f659f061c0ab35d6ff4f189903a3cac149e9b433f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9312035863b77319f0acd11a6ae9ef17

SHA1
2b711539f35cb70e532c7db9b97c66cb39e46bb2

SHA256
c27fe8f1cb25161b9a39e285a9d412bd3fc4365cb4a01d60ec5a70701fa92b97

SHA512
c2930b77d4e47e09a220d8a36b9fc4f1440f8ad943dd6eabf61707f2486695bb8d2ac43cac70081c5485805b9c4a80b0643e46031e3428c903ced3e6915b0e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38f70edb8482e357a0109ac35cfb321d

SHA1
35356285c24f0953d4020103ae210497b2106483

SHA256
55d3f82018d9b747bef4d3d52b20cd6f1ba899b2ab424caa1e9f17ce1fc68edb

SHA512
d034d5e6266367dbf3982c48785943fc8e0db237ff8b1718cbc8efa477e620221ad376b33f936183b05b535145ec97b92a7252363d4a165c68d1ffa68fb7faad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b4cb0f99d4b10010e01854bc72ba35b

SHA1
f059c31b886e8a166a48176fc87bcb165423d898

SHA256
00ae8d279641ca079f14019027c6627c54a5ea05a801cc67a054910c94d6d032

SHA512
560d9507b83edede6cead5bda1ade1892977e6966ea799e78da3c877fed86c9a7776aec9092567535c550729fcb72ff98e5a0420d8815577d88edb30ae331308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79bc454483f9f1294ddc2f5656333294

SHA1
96f7658771b939ad4cbb2172d6a8597ad25ccdd8

SHA256
9d171b2ccf73d800a4899d5c3d5b6fdfdf4bfb447c53dbb528a18282f39f42b4

SHA512
74b6887d8ad18a32f8c95b183c043126a94c2dd671c2dbe43e0d2da911409b21b8d0c0013cf7026b334291e14d6c1c8b9b0437146cb05726969c0ce7cb3d3c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c57fdd1121900dad0565fdf5d0cce5ef

SHA1
4fd1a5d73edd7bca081a979482b51d71f39d9251

SHA256
7971427d2d9829990ff6df5840133a6b801e0b84611ef1c562074c8808fcc54a

SHA512
ca1196dad7be3a1c026e16e926a9c5a57809072829b2a7d07ed20dfb0810d68cb6bea6ec2d4ab01d8b9edeb25aa886b36a4d0edeacec6125adf6fdce4074d1fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb3f.TMP

Filesize
1KB

MD5
71cb5d71201b62d15b60d1101152175d

SHA1
e09a6b537a692208b4a857248120cb08c8683858

SHA256
f494a5805e2653dbf2a2513b3dbad6b786e016b88cbcc8546e3a83831ecca6a8

SHA512
286d1249d34f66a216290c6a3364a1cfb251a442518662d9dd155410742bf784e59571fa251632f3de96081babf3c166b2c70ce0a10fd2dc76f75375a93125b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d00003b7-346f-459e-86da-e29a94e60e28.tmp

Filesize
11KB

MD5
ab4dbe40e211088bd2c75f15eaad2289

SHA1
3b3da8c80a06073b7ee82475fded04808a43fa1f

SHA256
1c61954ed5b02cf22b97e95bde3da2c0f0262e792854d77849b1dae22edbb9cb

SHA512
581b5df0469572881f3799ea033463ec7516064fff9ccaa1466f4fe4bed939b3ec6c6806e2c19e167c1191e621881337b98f28c0b98bd8e5d99e2b1ee6ff5822

Download Submit