hxxps://anonym[.]ninja/download/oQpZVJevYbXkMvV

Analysis

max time kernel
138s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10/07/2024, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonym.ninja/download/oQpZVJevYbXkMvV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\10-07-2024_oQpZVJevYbXkMvV.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
3504	msedge.exe
3504	msedge.exe
3560	msedge.exe
3560	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe
1140	msedge.exe
1140	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4100	7zG.exe
Token: 35	4100	7zG.exe
Token: SeSecurityPrivilege	4100	7zG.exe
Token: SeSecurityPrivilege	4100	7zG.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
4100	7zG.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 384	3504	msedge.exe	80
PID 3504 wrote to memory of 384	3504	msedge.exe	80
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2936	3504	msedge.exe	82
PID 3504 wrote to memory of 2188	3504	msedge.exe	83
PID 3504 wrote to memory of 2188	3504	msedge.exe	83
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84
PID 3504 wrote to memory of 3636	3504	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonym.ninja/download/oQpZVJevYbXkMvV
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b38c3cb8,0x7ff8b38c3cc8,0x7ff8b38c3cd8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1756,8645316553671080833,10024219879511206665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4820

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\10-07-2024_oQpZVJevYbXkMvV\" -spe -an -ai#7zMap9949:114:7zEvent21523
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc52695a78aa4e8734d73b7446ba59d1

SHA1
15dfb5759ff566206ebd6b8a864e9e43182d7f44

SHA256
fc18d4b0cbcbb89e7f9cbe630c18c94ddecf8b59e74718cc5ad1f66fe638cf9e

SHA512
dbddeb1e9678141910933db917260164cfd07d5f2fcf3c7e82fc2c6db486be7dc47fb193a676e7a23d4ad6936c946ede8def1c555332e41a829d94c207cbfd51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce971e4ab1f7a51b5b9def5887018d15

SHA1
2f280b61a4c3297a3129d59b84ae971e90fdf9d9

SHA256
12e7606eaa7e67b697c8b098266fcb8cb066cd9f8f60ce43ba8405102a63af1b

SHA512
5358fb373e7ef29ac278c33161fbd06b4ac59b24be16e4c34f37ae88383655a182e30fa71cb7881cffc3af5ab055aad25d57f53f3114e6d79b946dbfaa228594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
31d26b8a90b4551fef0377ce70ecec47

SHA1
5c78fa636d0ea42ef1b2b7cd47f1f807900fa7e9

SHA256
d10cb81001520ef7d2cf8dc1f21386b22c7035704af1887cf7797c9a8147382e

SHA512
8d0324f1cbf64de5b32dd4c2aaefe73ee130cd638225d07dbeb9a7007fc844bebe7be6c8921e0c009895ad75440c898bdfd2a5daa8f99d9a2997f0f9ceea73c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5331be60e021b6190922c9202c1477da

SHA1
80c4c27d337b7398f0fb24b8c7c6bff3fde5035e

SHA256
8c5daea8fb6ea7a54de379a5784db2ddb57a18aca5aea0f76647b0cc0ee994a9

SHA512
75146e365cd5d01d1ee924d748c779ca9d97c12203062ed3159ea4b569ee6f2eea9df7e23e1d6e184d1dadd78fc227dc15c25faa0fb7b3aee7de42a05f8ff806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a80e5fbed2ccbab011210f8106778bf6

SHA1
3ea1dddf61b3c14e5db398bb30ce88a685f2bb21

SHA256
075323fa863aa6fd52fe94aae39dad74e0442c449e896293692c158bc473aead

SHA512
538623f6f2f9e32ba54afcf72cb457d1a471f1cdf3277ae8a330e041bd5a3b4194ae6f4e60f0ec8de04a8dc01fed20d7278991b0486cdce79b6ce7ed6cb4e6a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce603ca2c3bc246251d6969c0c9ebb3a

SHA1
cf3a6b0c6068f393aa8ce2cca52c0bb6e2fd6839

SHA256
1429e7549a514a7dc57345929a2c00a883cc14910ea30d1cf8b8c3afaecc7971

SHA512
f985c57bb2424a79a0c6f3cc424c0dde42c8a60be7ca0e7c6ae6b89e594d27482b8e2a4337029ab892b30b0a74dc2e37d6b1d260cd6518b98ec496c62cdaf84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d61cf594d0c6f265da38d8bd886c18b8

SHA1
a0b303b0ec82452ba08c15df515aab04121d1b98

SHA256
cfeeb2a4a7a580405e4dbb75deba6d7a3ec14ccf62dd4f5124e256258fa23d70

SHA512
eee014709af1aaf5dfe6609118ed4606635c36796f9f921d4344544b015c72f3da430e827a884909cd6876ad1e10e5f4cccf03ff5d855b2dbba548fac352ee41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb22c09ecc5dbc6bbbbe55fb76136956

SHA1
8b24eddc94b589d1755bcbc2abad13c59b31204f

SHA256
96008a05889377bae45ae323eac0f33646916e81ae16ef70968b366374e5a01d

SHA512
9be91851595a4f46f29b5ba193d01d90ff88ec744b66d8c4851c5b50dce3a53d57bdeb2f12b55c63f556d0681dca4135f1367a5bcb16e4f17f4e489fc13688e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9389a5b72a983f9e79b937a829f29fa1

SHA1
6e29dd179b2116dedade37a572461492712733fa

SHA256
aff8b884ec6639860eeca0994009046e6ce6754ec59a6eed3f6c7b830b507688

SHA512
0619c4bc9b939a55d6e9062861e3f648182c280c60c617972f12900ca72d1e21aba9786b46b739e47732f45f3db350ebec8e73c5342ad0df23ddd55f4e2fa4d4

Download Submit
C:\Users\Admin\Downloads\10-07-2024_oQpZVJevYbXkMvV.rar

Filesize
508KB

MD5
41398ff63b541cbbfc5895ea1b69de36

SHA1
d7108576761782cdba71cd7826f61d0f73930dc0

SHA256
62c1212deaf916cf611811e2eb912f2e4e3bd8443604dc460bbdfc4dad3f9053

SHA512
9277b2974928ae85ab57fc20fec4a7bd0b107078debd3383d4069478bf3bc10e7d090146c6025ae2e2324da152f1a7bd65ce7a3249d99fe427fa497260e6694c

Download Submit
C:\Users\Admin\Downloads\10-07-2024_oQpZVJevYbXkMvV.rar:Zone.Identifier

Filesize
153B

MD5
19c44fb06cb9712cbdd89be54c061e8c

SHA1
a7edec6f38c5c0546c8126187385d0441d0ac921

SHA256
b77f0cedc3edc79ebeb1dcbccf1f993a10ffa0e7e8e17d898fe9553e4a16d2be

SHA512
130cb5bd239516e6d097b3e57c68efca639616ae402d41d98251e7365e67265e675c89795f6a75b87f75ff92d16e56a281f62df46e066b4e706b65f1b119de7a

Download Submit