hxxps://www[.]amtso[.]org/feature-settings-check-drive-by-download/

Analysis

max time kernel
160s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.amtso.org/feature-settings-check-drive-by-download/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 811233.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 406124.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
232	msedge.exe
232	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
2480	msedge.exe
2480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3884	232	msedge.exe	84
PID 232 wrote to memory of 3884	232	msedge.exe	84
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 2620	232	msedge.exe	88
PID 232 wrote to memory of 4648	232	msedge.exe	87
PID 232 wrote to memory of 4648	232	msedge.exe	87
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89
PID 232 wrote to memory of 4208	232	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.amtso.org/feature-settings-check-drive-by-download/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccb5046f8,0x7ffccb504708,0x7ffccb504718
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4801979622147026316,18251775075964234926,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6608 /prefetch:2
  2⤵
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
c637c6d45d32beac665960d02082de7c

SHA1
c68031c08297a8fc6ab93f4151e3ad524beacfcf

SHA256
fed0dfb79a2fe63c2ae150ead0a7f318306fb681799fd304e6458cff613c8710

SHA512
ae40e7bbe0dacd2359b7dac2bf9688826418f7b6b7f92e810c7c30758121d470fea694df4b0690188cffe4bb7144094154e4c6ae4e7170578c7bb38b321fe15c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
618e339cfefa5c61ae9fc91d14068dab

SHA1
2414c9163d28164d09abcd163275508b6035c882

SHA256
6ae61ac64721cda6a5ee7a16088cd6a0f7fc85a28dead90d1e23064e90d97438

SHA512
f04be355d4f76a2576d3a46fb36ad06d8ca8f7dfd3b2e3aff63693b6cd4cac620830eecba414d4f2b847070fbb679e8e5e2fa1a42c4d6f1a8a606f0261387164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
649B

MD5
0c974e19f608a2ab0bd6d74c25cd5009

SHA1
0e2bceb0ebf93c46ae1b6020bb5d660e702f42d8

SHA256
6ac3752aba5dcea5211f97e856f652a5fdd2b394ae209ceec731c00c5e1b9a20

SHA512
39f0db2e906ea79f42108b50563e7910ed9293212fea669b05551728f8b0224330ffcc6f5ef76a3547054f2067a994e673aca04adbaf3878444ea01d56b4c7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b8068b5309861a2473ec20c6d3d6404

SHA1
e60a605429f808cd1429e7798b30e10532235121

SHA256
fbceb66b9e57e9ccdebd8fd4f7c4e3ff7da3495e1d4feacd57dd7f3a2cece026

SHA512
99f8119a74ae962029f4bfa72e32553faa411ae36a005df1ac042b98397a4771fa293c778825b4d1e511caa415d565f83287917b50a2bbd9356a72b6f3931eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ea98ac9b8ec24efac68363a89cb1f4d

SHA1
18eb1dfaad1b607d46fcd624b3bd9c27a370545d

SHA256
4737b5ea6770686b0d1b2a3b04288f3bbfaf682d5f93fdd437b511e36a2f49be

SHA512
d18cb290ccccf38c9180318b5fce89ee909eb0b266b3c809e0df71af98790ac4c32a0121dec0ca5f7e8c27a6aa45ae22e028af624a63c038347f218692253a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f18702179be69bf238428c91465b82e

SHA1
a66a6f8ffd38ebc8daac5a11859212f26f2b4d0d

SHA256
0dc7f51af9b20b06c5c8a578208ba19ee99aed5455e9621a29be30d969a7aae7

SHA512
d850012ac60c9576a58a7c781f579bc193c16052a85b670e058b48b00273bb5777cd0cf1e6e01e3b9146913371af83f85ee77c06d696d3d22ce4cfe13bfc7688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db8ea88f830bebdee256ad7a9e220cad

SHA1
fe4b4e2a1305d36df42984b9182dbffd98ba2f4f

SHA256
5dc54a21bd89c218c6a51da1849e900d3954e18f4f8ad023c9f3ac414a99acfa

SHA512
4db21adff7f584019423ff3ce9340b4f1b28c566a563073df800f2b112a3ff5c63ffe54ce3c8b0949552e125cfed29c7a2dcacccf4f4a9509f4541d9a4bfe00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e186c0e0096a443c45e5efc0cbc8f2a

SHA1
f203bf8d5fc4a7bfe97647fab0b731d09e43a0b9

SHA256
ff812609514b137a07bd8d156bc3a96053f5c3384b5a9eca246fcab795097be0

SHA512
9af6a0f42a6c69ffd358f6b566c58c6101e4ae505be64a3057b2865d63a96d6c73ba586f4804b954b31b5f4d9becb3a9ad59ba76240429faaefaf95bcd024c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d1930d5f88130731637f12c58d95094

SHA1
e2cd8c42c180ec11c6bae951d0a8d22734f1b76d

SHA256
697a0cb56f5d8e5a06465b65245a51a1625099a66325be351989ba8bc7ee473e

SHA512
f43cec76933c9d9342c92bd5b79402bc0ce74be9f79310f7852f874884013cd1605b2d07e13414ffba66f68d562e444075c80af7376abc28f2099254f2c707d2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 811233.crdownload

Filesize
70B

MD5
aa991d6e29bf8eb4c1b56c599dffce0a

SHA1
506db7cc75304c29459061ebf9d1d3305aa5b798

SHA256
e038b5168d9209267058112d845341cae83d92b1d1af0a10b66830acb7529494

SHA512
44a53bdaa03c3fd5fede06dffec3539650d6cb2d650237a22dd8f1a43af7d1a2d0be6b9e290581793d7b6f43a0b489ae7a749ed0a31f93f189bea28935565ba7

Download Submit