hxxps://github[.]com/fire6945/RogueEditor/archive/refs/heads/main[.]zip

Analysis

max time kernel
84s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/fire6945/RogueEditor/archive/refs/heads/main.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
3832	msedge.exe
3832	msedge.exe
2784	identity_helper.exe
2784	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 5052	3832	msedge.exe	82
PID 3832 wrote to memory of 5052	3832	msedge.exe	82
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 3952	3832	msedge.exe	83
PID 3832 wrote to memory of 4828	3832	msedge.exe	84
PID 3832 wrote to memory of 4828	3832	msedge.exe	84
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85
PID 3832 wrote to memory of 220	3832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/fire6945/RogueEditor/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff561b46f8,0x7fff561b4708,0x7fff561b4718
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14594628245191652168,8939295135243546185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
d11edf9e08a127c768843acea41d0bc5

SHA1
ff1af9b39de4a3f547407fd9864ffdd2bb6c7354

SHA256
217e4d9d1412e45abf7a653f72a5ab8b53bc8fc6f377f52a042668a41abc7478

SHA512
92c3f0def567b0e2f2523ed25eb9d4abff06070b8be744fea4a6678f25f292439d7bc0c8015eaa6281b7f43149eebb3d3821cd6d6436598481113694b11ddea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
625cc86896cf3695c884ca4be5f2afaf

SHA1
a60234e834ecbc43dd71bf8ac241e0cea39b3dff

SHA256
a3d940b3f4a51ad9623f5b44494c53499d38732332a62e78e3b3835ccdf156ad

SHA512
1db3ce07c69dbbcb65367bdcfd0d1e5be2299a085598af963590a592c85815257a52bc74a7a178b75e191a9cd83a9fdba34ce7a5c380256c37809ea7809eb4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6dcbe6e18f6c470bb3f3294efe729e3f

SHA1
aba138ccaa9d69972204ca6477a02e3245c83f1e

SHA256
1dff3a16eec11c23b6d9db4be13887d141f0dfa10a04bb152e851aac8a181495

SHA512
dbd647ee1db5ecc2443c05dbe85caafb4f57965487a8ebe119e70e25ce81cb743cace85c28464e4a5d27744474e7dfcc4e9042cef149151458d035f1179e9147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b09bc6abf735709bb569dd9555f3ce5a

SHA1
22ba55d2f1d9d8eeed6f404625e43f5329355a19

SHA256
a38f8cdf449c071fdae66dcac1918eb9666269e801e4e331bd2cdbad9b054146

SHA512
2716d74d3bcaad895ce26fd4a7b6c0269fa91bf39c71a667169bbeb4267e4c273301407eadb1204a8ad62229493ed3f63aebaf6e01b6c8598b1cdc865f3382e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b26e90d383ba948a8b4788866cee8dd

SHA1
a951ed0c44e618d3d22ce45145c3ef4305f70463

SHA256
c49bd2ae1b5bab827cd403041344441f69c4da645f1e9f9b8f7079f07ce960ac

SHA512
84c389aafb5f8ea5681b25ec5ac4fdde7a1644833319949d5904ccfc46d706832c0eb920be821262e6719056ed7a8d268585c3cca09e30b674e4bac444c980be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b40ac1a6f9eb136ca79d2069ce4902bd

SHA1
9dac9f53e26ef50acb0c3afcbe4b5fc3e0188c10

SHA256
918c800549ef1d777aae0db93a778d7395cd9757fc640fa4d8441ee91634e953

SHA512
a479e2b57c0ec756df2bd52a00bfe2cb73de04238ff8947a60d2fb63c33610e8ae6b9ab8c64a467b124094451e27491a7f89d4c3d3ef2a16417f666a7621f584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c071.TMP

Filesize
371B

MD5
37b3907bb21a693d04d673bdd8d1a0ec

SHA1
19b3b5717348ae00c5e0981089bea810b2073027

SHA256
cce769a3a5f6a29bb5fbb73b3c5b7ea9a8538cc9405c9e130eaca63cc655b55c

SHA512
6a9b26284053fe81c8549f969824f35758411476219b205898256ca8c7ebead6c56083cfbeadf295fc5cd43fb00c3cc38e2795d2b5ad9978e95db2a12637e1f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36377da13aceef10d310c4870fb806d3

SHA1
a3ed49c1b14cf487e520e0d8d7719eb5082c7bd5

SHA256
e8b745c9600960ce3d8737d002a934d2c90d07e1b2c8a3d918ca0f1f9ea3feef

SHA512
794d01655e7c940454f8c4237f42dd5c48133ba40d79b6533c61f9e7c40925e3473859cb5555f6896e7af85f5473c441e0aa3b237dccfdb8f32802fe2525c7e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a3542817d9074603e933f056ead7931e

SHA1
03b45470ce1947b49cd335daf73e39ac92712e04

SHA256
2bcb7998028aaa0e04713832fdd1cf6ead96625e2f50249642a0e54813b653cc

SHA512
74a2a38a356afe5a0585f3f227bafabaa80781edb681f87ddbff70ef00f3e5087d27e63b846c970652ee993531a08bf08c591044a266a1e2ad304a0f4cf38e05

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 988105.crdownload

Filesize
1.8MB

MD5
3f0f281645c78eecad713a385fe143d5

SHA1
e9f662f38cbab6e825a465fe59d92bf95a6094c9

SHA256
ff59560d009381ac5ff74c963a7d4414e133e37ff2a1d40226652002e644c193

SHA512
e5e729ad5dc037dba8b5140fe5247ba781e8081ac9bd95ea23da20f6979b1eef79652278bd282d668a2261a7ab64a10eb39dc193ab1f4f8dac93739a11ca26d0

Download Submit