hxxps://drive[.]google[.]com/drive/folders/1VTcYbmiGAxZCJLCQ6QGmLsNv7PpSEAEW?usp=sharing

Analysis

max time kernel
1007s
max time network
1009s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1VTcYbmiGAxZCJLCQ6QGmLsNv7PpSEAEW?usp=sharing

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	Shark sim.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
13	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 483591.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3444	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
3212	msedge.exe
3212	msedge.exe
4004	identity_helper.exe
4004	identity_helper.exe
2912	msedge.exe
2912	msedge.exe
3360	msedge.exe
3360	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1384	3212	msedge.exe	86
PID 3212 wrote to memory of 1384	3212	msedge.exe	86
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 3384	3212	msedge.exe	87
PID 3212 wrote to memory of 4952	3212	msedge.exe	88
PID 3212 wrote to memory of 4952	3212	msedge.exe	88
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89
PID 3212 wrote to memory of 2592	3212	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1VTcYbmiGAxZCJLCQ6QGmLsNv7PpSEAEW?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe9146f8,0x7ffdfe914708,0x7ffdfe914718
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_desktop.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Users\Admin\Downloads\Shark sim.exe
  "C:\Users\Admin\Downloads\Shark sim.exe"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14917553360070250658,7961399753536904220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56ed59b1-5bbd-454e-a35b-21dbb3172f76.tmp

Filesize
4KB

MD5
5a88dd758a540ca5c6d07a2f622a310a

SHA1
12ad9ed3b71b41590fe4d4da1d3f9cdaaaf7dd9d

SHA256
8b92c52989124be3b8f131091479be0a5283f7e40b751c80d2670574204dd21e

SHA512
43618c83f2df88630e51818ed85b4c9eb573432baf881069886e7c30e1c5d4e30f62731b38d5dcb35d3e05f093b61a18105ddf787c80a91a24f7b377bfe4217e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66392107-8818-480c-a79a-86babcca93bd.tmp

Filesize
4KB

MD5
0760ccf48e31b1c6dc3dbd74845802a6

SHA1
dcc90e6bbde97d726d8538bc615bf9b415387eb7

SHA256
504a64a48c4587998ed1f28fafcee250a715a68e3b5745097050494fc272f8c3

SHA512
a1f3dc0146f1f8f4b808d014dad126ae4ee37a95913d3f9e2a0118a89b7060114ffd7dc6b3223de449a611572bc1c31d37e8d3ea362b759d01d40f23143ebf8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
28KB

MD5
bfb4ad144233248db8f0b493c9f53943

SHA1
75f204ac49008ca945d35db03568db5ffa2ee27d

SHA256
57819395af403b8697d446c0ef64388fd0f4b33af5647bf8a79d0616cd903393

SHA512
0f5f4ffdc046a81da203998f22ce0f156036b3c14646faa1b1c30d6bd0cf5138b70b3d5ac60b2b6eed36d2beadc108b78119f757bea84705ac71a8f1b3d4dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
d89946948d8ad4b53f5c471164837315

SHA1
5f15c0c1e388a14b7be529e6a07bfeeaf9075bb1

SHA256
af71410c1956835864c1bea5bac58dc171b502683b5028f2222560f01046b278

SHA512
a30345caca6ecd193bcd1b8113df5b5db0dced5eee9b866cd6bca272be1f755153c6739346b26dad67a31293e362f0563f78d16308227f70b8f41435075c9fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b4642e4cad256ba8609264f7dd4a2b27

SHA1
850fb4656d3d9699ee2660800e910a149240b5cd

SHA256
8b37f8bc11393ec1669bfbe3824a4688e0075d4fa72b90ba857dddd633a58b9f

SHA512
aedb7ce053bf9d6b81f726eee3ada5d5859e4b4a016f4f1c34043aa27a673101cf959f15e213f8a24bceaa7d1d557601fb1a321f85e7d345a28ecd98e74f3388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cb81c5672ca3e49e84e693c1d4ac00f7

SHA1
2269a0e0c7c026409f6e450e6039362d71896aad

SHA256
3efce2e41be0a450db7de9f132240fc13676dd13fe01ab026df021efac3ddb59

SHA512
66461173fa25de611d50a040e737bb532209fb8cbbb189d0fbeecefb9c75a3f6f1a2d01ef2acbe6e3ed4c96dddef06b191dcba2f4f876ade3d781eaafd8d2acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2da406400fa7e516760b03552de30537

SHA1
49123ba8dd3b455119f0c48402cc4890914a323a

SHA256
2fe9a3e5bc6366f85456381d56d6832c79145afdd9f3680213ec973ce02bf6ae

SHA512
b73ef0ae4816d5f1e956e4e01f0bfa2d6b59d2e1b52c98ab54d42785b4061261798d99552981083dc9cfe57e836858dcee6d113e8f0c01b1aff6fde39763c653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c72e17fd877125ce19f949f782dcebb8

SHA1
1c973120456f110d3b97d38111eae5562dc282eb

SHA256
ea159c877f9e19b32dae162c7fdca01e090d76d4271f83a083529b333109e591

SHA512
c9e48e3132840f7a8a665f4632b0cd5a5d71f0273213baf62ba9e63a835fca0b439b300df61dfb01bd9c2c56729b5d41695a970877ecb0afd70013c869f7c9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
321c9fc701650bcb7faf8e950b8f04eb

SHA1
987e18dc6d04415a2f2efbb8dee8ee60d489614c

SHA256
d5e056134bfe4ab60854cc729edb80d337d8d1e60237f16941f9912bd391e3c6

SHA512
72efb373ab115f22d95db7001e4512f8e8f3c0504b6b83f77dc5fbde2b2c736ef35ce8df834125bc5f9937d6c9c076440bb05f8e0f28fa623a8ae93edd21e7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d938df0a1cad0d67c451bf49e76de7e0

SHA1
bc5d233225c89697727278c1467af8ba6fabc5dd

SHA256
f7627aa4231ac7356773b77c4cabcf34ee49bff7ab085fb3d41ba33781a81f81

SHA512
adcf3cb7ecae0d03e1d1a740928b9efba28c5fecb4ce2a5f429f5e1157790ea98fc33fc25184b1ced002953bdbfe094006b51ed408348a87ed0d7bad90c6b48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
568c7e42682a549bc79baddf808ba2ee

SHA1
8e441dfd01220f426f506ec4655f5dae77d98a82

SHA256
404510c4d7741aaf22f15841440445e20c7796f697eca87c3f0d9f7414eef653

SHA512
6db76a80cb53933e6baca358c0fba0783dee8a8df0c3cd061a88da0a16ab32034795a109b94053406924f1aa341a35e3e232b93a9f02874804194dfbbc015572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
362fefae62b2e048472f6a4cb620dd2f

SHA1
243f5c5534810f2cedb576fd918e8e970a996c4b

SHA256
8ecec37f9f0a801f183b8281f4394e6b6c30c5e5ce7ff73325cbf8442dfbeac8

SHA512
4b42e598efeeb567ecb358e03c629fba310a11f94326c7a2ba3bd248e193d9c96fb76a295f15b428000c20b5caa56a1d8ea263fed0de0ac2c4060cf809c0b4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
17b89a30e4c82d71a20d32f7f002e2eb

SHA1
fc1519030492fd2d4588cb9096ba699449b20c64

SHA256
7708559d4b6fc18780ba6118fd16ae6f6eaddc2af65c4062c82041879e494e37

SHA512
b1393859026b1bcd4a024815daf224247e84382217627f696f2c7a7025d1f6963d9ee0f44c384b00dfdf1d727388a3518b46843d8bbd146c64a1165ffcbe3fa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
aadad9b7a6dd8be9558b3075e75976e5

SHA1
80f7fb8b9a418461c95ff2d7f6d25e73314586a9

SHA256
9cd55f532b577e840ae3291892b80a5cf438acb9fac1b7876e632a020b7e12ae

SHA512
32f843782b8d88fed2098ad84691ab7a42a7ccd2482cbd61183eb44d77343cab835c1d160960490ca7b0d8baa217fddd1cab1ff6b98d9342fe398b4260cf1a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d651984abe5425ee73cd60fa70ec179a

SHA1
5f81fac380269c80280e32134f3a0fe1aa53239e

SHA256
8dde4e60bce064a246c76161dc7af849506991ad2b9d5801096659ed097ab538

SHA512
53791ab76a09a307791b2fd9c14190aac1d5681c9ea6b96e863fd24fd6e6bb4aed0a6a0383390c9f7fc7927cbb478bc9b8a51dbddc7e594e9fb0de0ff37ba5d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28a6528d53e39af3712026837c5b8d10

SHA1
aefa726abb4826567f12c3a8e8265052825f6ce4

SHA256
a3aba2a34672f839bd1007a3f947301808d1895f2bd30a82229bc52f0c855bd3

SHA512
ce2955aea0995c753c7ffd574da374d67913a6059b0425af4ef83e6f0fd750ad599ed307b76d10360df55effadafa60616d938d84bb7c53e0d69de5c3f423204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fb710741e38a6c2db90f592105fb835

SHA1
4f5665fbd6ff07ac6a5dda3a06d2801321b6c4ed

SHA256
e5069097400acd4a4d9da2f91d10f12cb500c6b9a54cddb9448079e71c9036cf

SHA512
6ee957519c8e0abcfcf4d0b96b56c63f9461700cc37d46d590901c733d086ace6f1253736de13c56371cd3586e20a3cc2faab53f90afaa8f2f78ac343898a576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45ed075adf759227381317ca56a7617e

SHA1
60cbd9ed4d280e4bf3e28cc4a6712fc7bc88ed01

SHA256
f3ac0979fa29ae35ea0ede6e6874388f29977bba3e14e42d77d282430ec52573

SHA512
b8b62e66f2d693443d5e23448f10a0585b68bf440e3ad8a96bc0a1461c57d980788084c2cdd614b423e9a62d110d0f7924a687380ff36cb760a6967ff42b9bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ab09b0859162785b0b9b11e53dc1be7

SHA1
6130dbaf611edba691dc06ddcc7426060cf8cab6

SHA256
ec61ac4c6dfb42b1f2f434869aa53e608702703945161d15369e0657c747ba38

SHA512
7b069b2e7dcf933f6a616874a21812175ba144d314ae67a9f99c13b0f5ea3c9151891ad4c9acc292fec75033ea2801d4a7fb332f27d4ad2ea34aefa0bb07e364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0b55fe0aa1681cc400b433a5e431c7c

SHA1
92c0aaa029328e75616e6a264c5cf2113ff17809

SHA256
4a996ea205fe601fa04db82e6cb56e6b1a052dedfba9e7f1930cc705511c49a1

SHA512
ebee9f0873bf1f45b8cd3657403f1e5a6fddeba7311bc2dd7139b960a65b862bcb4e074da05fdbeb1626dab483a3a0f399465bb0042f62a3f037c4741b04876f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16c79156d5b11313294b160bb55eea62

SHA1
6982c64cf7faed18e84ad61c2579a0990234cbe6

SHA256
50648a9dac8f9a14eb12f2be54dd64d0f13d40b89b1480d472db5700569a4219

SHA512
1375a7613ad763ee9d09c351387b82b383f967551945368ad0a9b24b2cf03f3dc2f579bfcee65e08d169f897ec4f0d818e2f7610a1849b760f017b2328d6b391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5bb283e845454b3c6661d57ef44c3cad

SHA1
a96aa5c86c35749c4e94fb266ed671564abd0e1d

SHA256
336fb2469a636fa6fc8795c7d77f33b20bc8e9188c830b6b15cefd0a1fc52e83

SHA512
42e86702e9ded2c215c4d5a2d05cb37236d1a5a66acc178d989ac42146fd68d1c3ef16a9e28529c79e7bd1bf3a201df2322aea90d5a1eb6a2916f0d398fe70d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6c0396d88c26ebdd6b943a613b0aff9

SHA1
5c35fba601b046c947ca3fae19724ec2962efec1

SHA256
4abeeda37d182aea1b47b66f41e0de08048a6a0d28222bc1794d93e74017f3a8

SHA512
a6ed246bc84a15d66efe8fcf6c12d092049ec217e258df1cdc3e05090a97133938ceccd2474b10eacd10dd142693edb0f8bf009ade8311b0493fdd409a447ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58212f.TMP

Filesize
1KB

MD5
5fa97b27e31f71f7570e01ab9aad926d

SHA1
848e48b38349b270f975c47d75eae20d1d878a64

SHA256
644945fed72362bc18775ccf4eb0a5daceaa2f0fd6fe1cfc7e16da1e7f22944f

SHA512
3e7a7c4425cb79ea4ad59e524eca5b9c27134bd4f7af753ed53f0281f05fc9a0694102a279bfff321b9e2b8d485dc65ff15964ed83a8ff8df2c090ac11850d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3049954eca93292c402866249cf73ce6

SHA1
8a5033583c630194192b0b9347a69aee4d683972

SHA256
01c9335a56b56c56bbb6698d952e99fbe6fd30b3715f6bec11d94822c1161927

SHA512
815a1a3a781983205e54e0c3cfa44c48d84e730cde2a3fcb19f3dd10c61683e074690f7f1efecc31453f758b2c3e749fca5a39ee45b9f8b5fb24e6af76ffb588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c185660983a013c0f42e712a0ac4afec

SHA1
2e1a91a1a50f4eb5e00e948451307aa5c85e1153

SHA256
a2c8e63ee17084e245c981b924e57ad0c66738176bdfd28edc1979c19eea4e7d

SHA512
90fdbb84ccdd7b9d4d61b4223144193dcbcc208c940db401914b3a67b5263192394adf17a61d9da04c1592705411696ecd73a1314c21e77ac8efcff917dbf575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
77f93a7b3bee4e816c36fa112a1cdbf5

SHA1
af5d98da6e8d23f50fed6ce3d3115e1e0cf485f9

SHA256
5879f9098821f5cfff83602826ba8490f55b35d08cfc45d5b62a850bee56ec5e

SHA512
33d8ce5bea15b24f86822470c70cafabdf6679f51b440501dfb2ce3205279eafe6934bcaa96d41ec7fde950fee5bbaffc2ad958df4819c7ee404a38d5405ba68

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 483591.crdownload

Filesize
651KB

MD5
0a3a99cf32005cef822b21f126b21192

SHA1
ecc6242584f41a7c554c82a5a0dbc155c8b80f55

SHA256
6adbc0698bc3039a09e67a1cc21e3b1b16f4857d4086fcaf5bea0cf232b8cef3

SHA512
abc1ba13ce2f631a5cd4842ee1ad35cec94863c6534b8e5d13e7c428e7f782f3a2cd3b2742b1eae783e7083f4728aec944c1a070a332a5b86181675d86ff7ae5

Download Submit
C:\Users\Admin\Downloads\_desktop.ini

Filesize
55B

MD5
adfae79a4afee31f30bd71bb97cdc937

SHA1
44c88dbb9ff8dfab6b5a834fd0ef13b60b774fa6

SHA256
134e9facb15c66031c055726dc042510c85ae2806b4c1ab645ad9d703e0420ba

SHA512
f70b8f43a18607389c2d61f80a7d3a34d74cde16cdfa7749946e1d69ab3bdd3bd6bbe9f7ec892507aa85eaed4767d988d91b9189f80475064e19d7473ae9af00

Download Submit