035e12a7047dc45ee52cb8094d7a7a500d936565a15279803861738b43e7099d

Resubmissions

09/07/2024, 20:19

240709-y34xcsvgja 6

09/07/2024, 20:15

240709-y1mv3atcnk 6

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
09/07/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

redirect.html
Size

6KB
MD5

8802e66b90f2011bb8c564b30973d4fd
SHA1

d5f03f85b2ea729a139bf8cc7e56240d334e7e6f
SHA256

035e12a7047dc45ee52cb8094d7a7a500d936565a15279803861738b43e7099d
SHA512

1e57a7bcdf5e6b25fb057a6ed15b9553688fcb52361fb2292ac4255a156c52f5c34641d90ba77332ace5ef6dce9a69c69ebc23ea917d28faf6c530f78888d7c2
SSDEEP

192:daHLxX7777/77QF73iyro0Lod4BYCIo0COtvX6+n:dar5HYO0+CIotOdX7

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	camo.githubusercontent.com
27	camo.githubusercontent.com
28	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Flex-Base-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
1088	msedge.exe
1088	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
2844	msedge.exe
2844	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1888	1088	msedge.exe	80
PID 1088 wrote to memory of 1888	1088	msedge.exe	80
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 2692	1088	msedge.exe	82
PID 1088 wrote to memory of 3080	1088	msedge.exe	83
PID 1088 wrote to memory of 3080	1088	msedge.exe	83
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84
PID 1088 wrote to memory of 3412	1088	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff81ad3cb8,0x7fff81ad3cc8,0x7fff81ad3cd8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,3983967575870143699,8424096381415320317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaeb604a99d78c4a41140a3082ca660

SHA1
6d9cd8a52c0f2cd9b48b00f612ec33cd7ca0aa97

SHA256
75e15f595387aec18f164aa0d6573c1564aaa49074547a2d48a9908d22a3b5d6

SHA512
1091aa1e8bf74ed74ad8eb8fa25c4e24b6cfd0496482e526ef915c5a7d431f05360b87d07c11b93eb9296fe386d71e99d214afce163c2d01505349c52f2d5d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fe10b6cb6b345a095320391bda78b22

SHA1
46c36ab1994b86094f34a0fbae3a3921d6690862

SHA256
85a627e9b109e179c49cf52420ad533db38e75bc131714a25c1ae92dd1d05239

SHA512
9f9d689662da014dfae3565806903de291c93b74d11b47a94e7e3846537e029e1b61ad2fad538b10344641003da4d7409c3dd834fed3a014c56328ae76983a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e0c531ee8fbda788ff54732d5222472f

SHA1
2c36cdb6b3d5c8c18b83fe7651f8a0ab85f04455

SHA256
5201ef46c4e5cb7df2245d6232e52a5e9ccc9ce9288f5cfa439e006237d1b75b

SHA512
79ad21cbd96bbe5c551c796dae72a9d854c20940d3a262f19e422bf56a1509caaa05c9408bc1cc298732ad9daf7dcd351745267585e58d0f69009d1d8204cadb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
394B

MD5
e08b0cd3e7d12b3358809e5660e5453b

SHA1
4a310bd3096088094867b7a9a1ffc5e09f9b16d0

SHA256
0602ceba5c9b78811edc5a0c0898a9faa365fea346f71822ea1a5e3d28bbffcf

SHA512
f4844de6db775be1f5543780cead21a84f556faaecf3c1b3af780868294e60f5fd27c211138c40e066fb8ae8a4ab81f40c1fd912caf82bf3aaf2968ccaa2906a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5fa8677dfbeb190ee420b46387edaf97

SHA1
1936e24301f2abcf2ead4792b5e1666bc0924729

SHA256
04e5a184a949d98f950d1497539d7de9fb7b6e9774109f7e8cdb9840996e476a

SHA512
93dce484ddebb0bbe6229c0864cb6ac38b21089319f44215bb147341be0726ade177f4491cd9ab1adc9daf5009d85a0410f43d1f70ace58b8a875c555bd0e154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e6ef92406389bb09774732f4973c91b

SHA1
0bd45a0a115fc4b8495669daaf7face5dd6f92f3

SHA256
11c554c40375c4cb549145bdc46216936df4f0f567f628ad003a85118ab2f530

SHA512
2c01e7b39d4f14767707bc6fbb772dedbcc28b7946dd682c210289af8de1c018029be4602a1ec64288788d0b6e902581187f5d14328640062590dae35eaa479f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3dcb402f81190b10ecedac6f4874188d

SHA1
c0f5030375bd1b1a8d072affecfaabaad9ac0382

SHA256
f6becd19228f9a247f20d98ce690847052504aaba2a80c195bcc09678dbab791

SHA512
6759c20acabaa872c72286f1c644da4ea9fdf883ce2828c707d7f103bab7151821cf8a353043e7fc9633bf96111f8bf20f880c6b59e52b617d2d18475be303fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f44e405e0e2b0d309b32346db60f9615

SHA1
3d2f1b226ec34e681d313f9469158d2ac816b0b6

SHA256
b2453cbaa1d389bf55758918675e6c228a6bbb12898c637b07cda91e5291f324

SHA512
a7d3548f61d544618dcd82764195a06fe1d16fd4c9b2bbd56e592b6a3342a24dbe7be9afcfbbcf032f428909a82d976a320dbc22784710d5b16731aea3d09c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4575def4d375915d847cd5e2211524b

SHA1
be8d72e427f257fb3c9a1ba134df90a7e46e4392

SHA256
f852110086d636ef39aa4e0d570cfcad3e9c939f6365d5db015243d8235d3c62

SHA512
80aeba66cdbfe0f91456d3b67bb6bb32fd32d860495fbc06d31880b3eed48ff9be8acadc9fcd3d9123f30d3f37e1e6b3cea018e3fcd88defb433d21ee0036e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fcb3f598d5e5b12cdd63f31b6d36ea51

SHA1
6fc5364193762f77d941d5fa5ab87cda61c70db7

SHA256
7ba8b37871e3cf2d6a1fa7fc2e3f6804991edafa32bff910658e8d2f9312d9aa

SHA512
d0547d99079fc0fc16664fd4a75fff884469199b6a07e6f96dc4cb986c41126f8e4a242c668a6a9303b4d51c264f99fa6fe09d4b4f4e7f4055753be6b2f70a3a

Download Submit
C:\Users\Admin\Downloads\Flex-Base-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 769356.crdownload

Filesize
22.9MB

MD5
63b94d659df55107b32f019e9ed6452c

SHA1
89cddca3da4126f8a7e1c70006a6d5492798aecd

SHA256
503622e5c0791a1906bc4086fc0cb523c0e97a9b86e596e7ed0afc6ce8f18ff4

SHA512
a3ef594b006ee42a7403d98c880f3b5b65333c21bc8b163cc196d3c3dd42aa68a3c052c642ad0020ddfd486ebc7b28015123bf92dfe1999f9e8800a01eaf97b1

Download Submit