hxxps://github[.]com/AssetRipper/AssetRipper

Analysis

max time kernel
71s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/AssetRipper/AssetRipper

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
18	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
1164	msedge.exe
1164	msedge.exe
1884	identity_helper.exe
1884	identity_helper.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	AssetRipper.GUI.Free.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 468	1164	msedge.exe	83
PID 1164 wrote to memory of 468	1164	msedge.exe	83
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2336	1164	msedge.exe	84
PID 1164 wrote to memory of 2264	1164	msedge.exe	85
PID 1164 wrote to memory of 2264	1164	msedge.exe	85
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86
PID 1164 wrote to memory of 2036	1164	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/AssetRipper/AssetRipper
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf8be46f8,0x7ffdf8be4708,0x7ffdf8be4718
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6575260188484755322,16382083927439354151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4708

C:\Users\Admin\Downloads\AssetRipper_win_x64\AssetRipper.GUI.Free.exe
"C:\Users\Admin\Downloads\AssetRipper_win_x64\AssetRipper.GUI.Free.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:52934/
  2⤵
  PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf8,0x130,0x7ffdf8be46f8,0x7ffdf8be4708,0x7ffdf8be4718
    3⤵
    PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1887e0e7fa17e44d33395f358f65ed4b

SHA1
bf8771191a16d7a8d09e08cff42ba2cae4ec8abc

SHA256
f8c508965d6c6ed452c413fecff4a7e841aff759a230b89caba0923d8966b4c7

SHA512
93e31238d14fea35ab3913044556a7c26df5cedb9f3716c920ce169eabdfdf4acdbaa5e1a7e52305dcb95f5e41611685100ec95b002b728c1fe77eff032d6a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
691B

MD5
6965dcdb371e1381208a2fb617bd43d9

SHA1
18767df8e93a8136250e0d7a67b34078d4280e01

SHA256
8d10a3f0d9f9cad982e0c854bf868ad76da6ef85c56d0c7526a7eacc3f2f18ea

SHA512
bb9d80cd320c4050d2be0bbf3ed4bf233746d531fb47621ec9d9057a4ad21f58cbac5f25bfac7db6e6609567883628353e8778b2e7836f3bcf6f8151d6a91a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c864fe3e0ccadc8edbd0e65626bb0b4a

SHA1
7e83c3719bf2bc99d6d9c1caedc06d72e0393caf

SHA256
dc3d1aa0045ca99855ffa8de2cdc5065c8077fb948d0eed7e6fb7731fc77f718

SHA512
71ad76f6a40da14b59a8832221f1895a706adcd5f1d32c4f9bf0bf54de17202c0b12d77b39b1fc07c3e46dcec24e48e5e8a10e2e542207cde0d1fc1507ae1275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65965db062f5304153e152402d31737f

SHA1
d611485bc47bb29b5799ac414aa150aa21796bbd

SHA256
fb3ba4f73fa19d3178edf7650d9b0159e81d2d294ccb01bcca3fa0f8f75b3d1c

SHA512
37a23dabb2bfd3f13ca991457297e94d3bcf0c39c682d8a8191397e35d71f29219905d0022e8fa1d8523507419b7cb8541dc69d86dceadaef5d543a538c827ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06a831867eced0d5741b6490a5c62d8c

SHA1
6985196826f98e739b6c5a17fc77fc3a85159230

SHA256
ac763a3896393b10f609950dced9032b7b741163635cc0358446d763899179f7

SHA512
8bb448cffbd7182f952f1cdcc298b3a8e8b2aecbbaabfd7ed071f43b0d7bfc2f4e60d28c50a10ec2a32bcb0d43f00bac9f3db2602193f7c108f7b2ed10934615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a6c04d0f71cc2d703a975133cc3b8bb

SHA1
a627d93878f4b793aa14aa86e9ec8252c1c9a150

SHA256
d44b1d5bb8aa0affa8558b21217b8d725382d5d44f2e9495b356c79a4ae87609

SHA512
991aae5befb9f5dd782eb6c501e85dd98664c651afcdb248ce84ee41153feccf462d87c042c25849c60497987a4af32105a0e0abe5658d8d0fd78b34a63ca5e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed99c374e09d017651df6380b3b0de49

SHA1
9842a608956f38f85cdea4e0fcd4569f1993232d

SHA256
cb0f3d14389cdfecaceaf07fcbcf2c877124697bfeb97269d3362cc75798b838

SHA512
a9377b30a1a5ed9ab4ec396f9165584c9eb16121500616c1d7b928ff9e3dd7f286a536d1429bef3c7abeaab6109a7d8fe6599086dd4462dca0cf1948309c7fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb246ff36afa719f37d72ff918ef45d1

SHA1
2aeb51bcbcdbb0110b0607311c718b760614ff3b

SHA256
b3c8eb76cf8e479edc1dede9d5ebdd95b9f13e92e6fa02029a01fb213e25fea0

SHA512
826bdaf5808ed9ad74079259bf5046f8ca1233fbb5e1d5ead77b604855682a997f18dd4fd6fa8ecb5ee64338733b5c6e0f75186ae8eaf8bb72af587af929af5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ed2f.TMP

Filesize
1KB

MD5
dd01a7b5f777c13f0688151512afc185

SHA1
ba02b44104ae2de56885f09b3c5977300f22e247

SHA256
6f02545e91264ac30b760c98b9bab79a16933a3102037a1ac03116f9d8a42e88

SHA512
6f3a9e389d8bd8ea5b2fbffd581dc85944b9dd25d97a2b23f6193b607f14adf6c09ea3a6de6c4855aace9cb934043de2ef3a133a5d602babb4e28e6aca3fd585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ddc484dd-f6da-4c31-94a0-6b638dafc340.tmp

Filesize
6KB

MD5
d59553baae458a13e63e87ef3c6b3167

SHA1
5aead00b59a93fce7e3af54bc1ee3814842078ab

SHA256
f68c1313f6d954b79e0701f9cb13e2d698272b087f678a4432e092a6af728fe8

SHA512
d318bb6c96ceab1dfe873231551abd51e4837e60e52bae8a1b9639e17a2a851973faebd7356fa02ca17b1ec5c42daae595df3cc16594fada96abc1c90d7db3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
135c03d84909e6337a71adcef475202d

SHA1
39b8da4fc655b4c20c1696a419f3cf5b5bdcd0bc

SHA256
0047cc1767e04e88ec6e0263fdc12e22b42a94ef97bca49c2ac497581af0a2fb

SHA512
7575d889dd1a66fa2e900fe1efbdb46a5141b458a8d0abf5745959115ba76dce5b1dbd19a57cc05aa90d6615ad6a66801ccccf119f290567d9f7432afa55574c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
464c9ef11c1e7a9b62db0fa3595c7034

SHA1
a2d2e3aabeedc348a835b2c7e713c51d3781ce4b

SHA256
a55414f074140356f12c21800c33e9e9ba08b9406ff56306c81e5c81c5e65736

SHA512
fb1d13dc0e1fdf491859df5f66c6f973018acd71fb9b894e792eb2efe71cf15c9b5cedd9faef7e9beb00f7ec4e8f212116cc9c87d7b883b40b3940751ed6a9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f3fa60b6aab6e6d78af0edb62853c21f

SHA1
d423faeff442d0b9f6fbf325d132a66b849cfc8d

SHA256
a4497afc1bec66a14fc884099803041f674d393f639b30e4d233729fe8be5d5a

SHA512
c79ad7e3cb9d8ffa8b049943abdbd14c9b7e5046d63ecf3d907dbb6349f46c45d92c9c7d2018d78fc2b3a4b862a25ee62caba58042eede94b3c94ba9a7e0c7d7

Download Submit