hxxps://gofile[.]io/d/ZBBWws

Resubmissions

02-06-2024 18:52

240602-xjj76sbc7s 8

02-06-2024 18:51

240602-xhzlgacd43 8

02-06-2024 18:50

240602-xg1r5scc95 8

Analysis

max time kernel
72s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/ZBBWws

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 986434.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 971457.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
2028	msedge.exe
2028	msedge.exe
3004	identity_helper.exe
3004	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2304	2028	msedge.exe	81
PID 2028 wrote to memory of 2304	2028	msedge.exe	81
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 2568	2028	msedge.exe	82
PID 2028 wrote to memory of 4788	2028	msedge.exe	83
PID 2028 wrote to memory of 4788	2028	msedge.exe	83
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84
PID 2028 wrote to memory of 3956	2028	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/ZBBWws
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe32e546f8,0x7ffe32e54708,0x7ffe32e54718
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,17862355704337755582,13632406624817571212,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
88b311492a3e7213d4f0fd647a8cc200

SHA1
170295eb9df194f3a710a533f1caa6b7d8e592cf

SHA256
4faa2d35c78c5696c16c417430bb7840a71d1a4970b702d4227cbd198e367927

SHA512
8e68534e5631751c8bcc1e315a656be3749bb2c2de9f85c7aacadafe7e362ea0ddb4532491152572fd8e9d069e06bf1a03324464470003378fc80c60e2bc308f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
1a8505bdd2f3e3db0afc0ba692498bb1

SHA1
3b4c96747a04b6495dc1498373088a77b03e704c

SHA256
d92c03479f45b52e328f9c1771bd97c999a5675d51ef9e12a2e69b9ba2362b12

SHA512
6cee966255ec779fce9d62b4678f07c248d8ad12bb379d9486a745b24acb3469b2f274b083239b2d529414c27a455cc7d6bd08f5b1d8d20c4461c4b9d9e802de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a785db5d45a7f855dc95dd244a653dfa

SHA1
707e7f03d9030ad030d9cfbcf42579074f446811

SHA256
87e99fd6285a93f3b09900443b686ef5f23f5a4ab2ca3d69bc4f31b2d3ebcbc5

SHA512
761be5a49b12603c14c45a38e4d50d2a89bee22ddfad566d0d4de930bca3242bca28001b5671c091f5e64c12854369418b3412a340093a917de70d7eb9fb3135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
140795116c0c7b2686f150504e3cdf9c

SHA1
bce5cb6070b018f58d141439a89953a5448351dd

SHA256
ca9bca7b051bb2d8d1121696c14162dd909e90f3aa2e1983052064747313279a

SHA512
2262792819b3c24b57937319e0efdfc3642f6927a7ee8abca59f84bce5492c142f108eac3af77b301441fedef5fab6388648899f52e1a662c78262e2b50c6e73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f13bf7f0c745cff737555bdc856e8075

SHA1
04fdd51aed5b757f089461626dd30e7c8b5a76cf

SHA256
b5a57f266e02642cd3bc2ae4b9e72dca329caee75891c55759180463a1d9facc

SHA512
c24aa19047dfc186d8ffb36966d3644bb033f81d39fdc27cdf4ab3fed8fbf468ec3ade025827e5b96020f4224d37b017fdaf1114b2ca6cd062bf11cc8a5d2754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b2f9e479cb66fd62768c0e50446a68c

SHA1
45ab2a5beac153b63247464b1110067e393fe41b

SHA256
298f9ca27edd18b6fafba79166fa15fcf62f3bd31f641cef6433cdedea63b971

SHA512
fe1eeb0ab616e8e2e5a11744eb26b6186473c1658a0e7064ea895ea64312e5ee7216b922935dafd04d628b45e187da3205d1e9617d547461130408eaed5f0a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
263200925d8598066eab9842a115ba18

SHA1
bbb7232beb80dc0279bbeca2480acdbb464a0e6b

SHA256
1ffd2a730d64618018e0ffaf1493773634383647dcd2508f3934a48a1361f4ba

SHA512
ab1eb1da957ba0c7482e6a5e6ac4cd79877abf769d346bd216c141e325f562980ef9e5d4f0c92b1e4567536a5cad3af39c72bec6077474154aaebd955304c33c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 971457.crdownload

Filesize
18.7MB

MD5
059db8cca6e81ade9387948f401c47d4

SHA1
8a6dac7d6ed9ec77016e2466224d487b26b7646a

SHA256
e0996d20778ae5b098f17a8e9cf5b8c84df41a436adc4317631fad5c79a239d9

SHA512
2db076ab3ff51d18ab99c1fdc1cacf8d6f8e889c29e996292b33bb15f67b86c133c7195a50747baebe28f0d9313681b9dd5e1bc2ceeaea8eade863003c06d318

Download Submit