hxxps://github[.]com/Endermanch

max time kernel
84s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-08-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
20	camo.githubusercontent.com
21	camo.githubusercontent.com
22	camo.githubusercontent.com
38	raw.githubusercontent.com
2	camo.githubusercontent.com
17	camo.githubusercontent.com
18	camo.githubusercontent.com
19	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
1136	msedge.exe
1136	msedge.exe
5060	msedge.exe
5060	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2640	1136	msedge.exe	78
PID 1136 wrote to memory of 2640	1136	msedge.exe	78
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 964	1136	msedge.exe	79
PID 1136 wrote to memory of 2308	1136	msedge.exe	80
PID 1136 wrote to memory of 2308	1136	msedge.exe	80
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81
PID 1136 wrote to memory of 3484	1136	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0dc23cb8,0x7ffd0dc23cc8,0x7ffd0dc23cd8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1640 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,7267464725407893143,2755578320620191883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1636 /prefetch:8
  2⤵
  PID:72

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
37KB

MD5
14c460a1feda08e672355847ea03d569

SHA1
f1e46ac6abd71ebbcdd798455483c560a1980091

SHA256
d1161f067875a5f686c1732a442f340142c6a03244f4dd0bc0f967596f6cbe3f

SHA512
cfd6e743986ae5074e73264ee1f311fc00a987bdabeeafbf55f5dd6ef0794ccc393507be9dc7e38181f2f10897c300edc297976acd3fb72da2bf560ec260af91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
37KB

MD5
6e13703b4b9b3fee9c9679caa6444f08

SHA1
eebd698908234ddf27a333105f645667e2eb7bf4

SHA256
e9c1c07f5fb1e96dc3bad0cbdaeb5503e38382e8e9c838120bb2652940d6baa6

SHA512
873bc00f546d9811befa014c4dd9ccaea032caa559c72674429ace2c1abfd292e2556de69e2db1bcf0641625bdefcf28955905a1d5b65c620fece0df82827179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
21KB

MD5
017975d305729c957b42440bb7cec4be

SHA1
4ecd64ae942d7994b18210b09e72b9a12c6ad7e3

SHA256
6c9f3f5cc1dfabd4377baced6215ed916ebeca530d76f5afebc7b18f3a6a8668

SHA512
216fb759fd6b7c18e738bf2eda55d316713d54a61fe7c925ef7d1dd82381d214a37bee7f3fdc9ca65c74585decf1a23441eddd6278decc9f4a178ae5252473ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
22KB

MD5
9ec8ba204f6c45d71c998a0ce1dd714e

SHA1
e6790bc2fc03148c9d9cc1b3a91f4c5df3d8295c

SHA256
a4daad6848500cbb261729ecded45a13e2f102d666cff8a0e2bf5991ea5e5c9a

SHA512
d30fe0c1f7589354e7b228a5ca4e522e198c6e7ed30186c54025e991c7dc9a324e1cfd243ed2009aed863c01c3b341ec88bd74aca019e13ad52f8dc2ff3c6ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d7c342771a4479465ffd1aac34d5e4ea

SHA1
29395e471f5de812ae17b2aa2136d11a2b9dd8a1

SHA256
48b3362967f108e130ca8577414c3c617e7873fde45bcf87f3df475706151746

SHA512
412c97bb9ee9d4ca84283ef0631d6a018ee42ecfb688f552d4b45b1612174febc2a5c4beb0e465cbae287b724a7b902f2b98148da0029ca0d3933120d6f72352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
663B

MD5
87016d9855e0938a982bfa229bf6a599

SHA1
6fb5f052692590f856e9c1da99fb619d651b2146

SHA256
3a2ffe7152ddafd07aac54c6ff1a989301229936f021296e4b9f249c6b984cde

SHA512
0a3ff462f5701742a7ee44a6951a304249c42d2155bf23a49e3731153664b10d7d2c96376981e2e51289ff7d4645f8a1334040f6f567906846184f66138e28a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30badd5f77e38059ab0341f968213bb7

SHA1
b53c136ce356ce7d3415cd8afbac52e43e6bb83f

SHA256
a1194986383e475490e9efd11425bb337be2eb532ffb60ede8169b02b38a06c1

SHA512
04d28cc5851897e0cd2cbb713ddcfa30a99d2a8fbf2a1a5da997173cefa9544229bc58b15bbb6350c7ecddf2a5343a7980940b660a94e892dd91f083fdac5247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
353fd50206d4584877f31d8a13c2ba1c

SHA1
c54c96bf9650893342d93a55b5fe1f336915397d

SHA256
18ea379434249795f06f899a26d89e88ea90d15de13866aec5d467507e67ab93

SHA512
c60c83145774e884fdac259d3d2d7b3b963314f025062e7a6c541c7f66fd0f27d379c8fd79d898065f2a8c23f75905cb5019aca4f4036353e01bfa70dbb31b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25900f1931ac94a9dc367856d8188125

SHA1
890b6421b7c89317dd0de11d248708c8350fdb2f

SHA256
75a3d075bcbca4f056344b07e9951dfe1dc848883dc0109de7b6b619e3765010

SHA512
319e18de0e7cb52a00977526ca994f25a017b138cad52dfcb1b6efdfecd14fb3bf743544c438146a888145b7797ed677b865ac7060216b8ad7bfa64105cc7342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9263c2591637e2385b39bad995ea5ac6

SHA1
8a3a90f46c50c0fbc89e82a4c627213c33fe2f2c

SHA256
a8dc44d3c1d82e678237d2a459153b069346d345bce85d6cf15d6dd9d3c993f3

SHA512
3c508083daa094c0b5b1e3dec39d5a126a7a65f2b51b242eb9587bd23b1d5cfee8efce6196b12525d35479b30b22586341585e06792a24e47f72d94b938e736a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7200a5d9be45be73991aa492b775029f

SHA1
9514be03d2f219eb34f921132a524b749cf162d0

SHA256
cac4a83a89b461e398f14b9c5ca4bef5ac43c047c412ce4acfeb5ef09edb8104

SHA512
4c1271fa2b03734c60876a8a2b0ab234356363f9738a2ca3eb417242b59ec43a1ed75981deb0dee34790b7f6ce1fe47abcdbebeac45492e13d9c8f862506a025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
50ead258404d739057b92f8f9e70dcf5

SHA1
3f4c004934637e2a52ca75187b784a8e2b931d24

SHA256
1c9ee200a5c4dcaa60809db8c8e471ec20e6a786fc36b87a00c8af37e0ea78bb

SHA512
892a4c6ffa39d2c776cd9276964f99ba21e4a84ef5d4eb11ce081f92ca35bdbb2c8d967e038265ecd9b7963399d781676dc7e7a06ceb7e5a0f7287d011268d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d626ac654802c45e924bf3cd1c944f5a

SHA1
7b4876fb21cbe237b47b94b7f7c471e5cf2624fb

SHA256
46e3e8c53fc482a60c1b9f3460f2f57072e1c170efabf3ce5f77d473c1ffa50e

SHA512
17da6ee46c4641d9d7c2728aa5cf773e05f3be0c57ecd7450412af1d933e07111a5f6573cd915423a6562cef5541ad0c7caf031f304ff369d2909502db9dce07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd40253afbbead9e12fd0f603a484425

SHA1
99845aecea8458955c75706895ada522e1c8f38d

SHA256
fc0035db4721ce5fe146b8e4f593563547f83e5569864f3158eaa49683cb9c2a

SHA512
8094f93e9c61e3df1ce3c6d231f57149506929f0bbc0873e8f9d47594629fa410e2415ff72c6627aab6a602cc2e492b5add1c6bd357d2a8115ebeef893c56422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582e2f.TMP

Filesize
1KB

MD5
50ada7e9f9327e49ffeadf6f99b64e0a

SHA1
38df50779fe70b0f11f33ea86a6515b847d53de0

SHA256
9bb46759009c6821f5fa9e38f9a40d41a3be123e8f8f4ffef1256e7b2c431e3f

SHA512
c335ae6fe95b302cb003140a4f919f05a343732b73655d5ae3c233748a286baebbd12ab5d01af28af44b73e4f5b63eec0f7084c00c4127c64d1c29782efbb8da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffe8aef4a645a4b111b83e46ac849b8e

SHA1
a73734cf4763c26ec0791a50ea3e8cfa50f2159b

SHA256
1ef4c05ef8bf74e3e4a1ef5ad2ecec3644ab6ed9a40b0805a8c5d139869bed78

SHA512
a3c17b4a80ac325fd59bd7d0474053057f420c0ed85ae4fa2bdd98e4175be21b3189dff562560466eb5bcad857e0f3532c26b78fe9ee08c7ead9ae101f1635df

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 286647.crdownload

Filesize
14KB

MD5
f3f982622520af32cc86d3a22f352af0

SHA1
99b7c8a8afa3cfc7292893d7b2253a581249d9d4

SHA256
653b5c625dc6f24dcab5aaf33e77fd3c994f4783884c21d0a71b5c1fefbeb4e1

SHA512
27482f0293b88c1a31dd1132401b4df19d3636f1a31f2b607ccf9a28dde0165381d65d9d0c492ab6c300bd1da0aac9e8df8c7cb3394cea35c90ce1a544a0576e

Download Submit