Analysis

  • max time kernel
    1041s
  • max time network
    1010s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-08-2024 04:39

General

  • Target

    https://drive.google.com/drive/folders/14_2b7Xm-36PNdXmwc8lUhryP1g7pNXcj?usp=sharing

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/14_2b7Xm-36PNdXmwc8lUhryP1g7pNXcj?usp=sharing
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe178c3cb8,0x7ffe178c3cc8,0x7ffe178c3cd8
      2⤵
        PID:1836
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
        2⤵
          PID:872
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3332
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
          2⤵
            PID:1340
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:3024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:2916
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2648
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2104
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                2⤵
                  PID:2400
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                  2⤵
                    PID:904
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                    2⤵
                      PID:1400
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                      2⤵
                        PID:1368
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
                        2⤵
                          PID:5064
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                          2⤵
                            PID:1296
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                            2⤵
                              PID:3884
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1236 /prefetch:8
                              2⤵
                              • NTFS ADS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3308
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                              2⤵
                                PID:2004
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,6681529523702368662,5146237186335325476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1256 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3288
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3800
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4380
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4260

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  d30a5618854b9da7bcfc03aeb0a594c4

                                  SHA1

                                  7f37105d7e5b1ecb270726915956c2271116eab7

                                  SHA256

                                  3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

                                  SHA512

                                  efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  03a56f81ee69dd9727832df26709a1c9

                                  SHA1

                                  ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

                                  SHA256

                                  65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

                                  SHA512

                                  e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  cd1c814e7d435bdfb1a1f1b28b50fd94

                                  SHA1

                                  1bb7644afc41e6eb351865ad3378b032c00c82d8

                                  SHA256

                                  74da45fb13ea0c7f57615d084a816fbb5cb43efc2bd74e63de45c75bed00f272

                                  SHA512

                                  f96c5b70fbfc502f03f3c40b0318c0342b3f4ed4bbf5a5461740c8cdfe0c78a6ec7503de6ca02e143813d0a37f8c854542d9a8c61116f694460e40f8a2051834

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  eea17e84e76825fb1dc03c5a8d8accb6

                                  SHA1

                                  da21490160308845b5e72eb151a37dd76c99b51b

                                  SHA256

                                  34f09d49b34dc49393da621bbbc44cab38d362e672cf6ad764e4fd1dfec06d2c

                                  SHA512

                                  307a61b4d010d586326def422d88e2ccb1414887882a2f09c18eb1b847f87e7d38477a39546949e16f319d1709d0a78d2070dd8a227241664a2c7609fece1e93

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  154ad9cb58b1d652ad2d2ffb5ffc11f2

                                  SHA1

                                  ad8e3a9003142360b470227dbc1726748d1a2bad

                                  SHA256

                                  be40f056b1d3e9d30a534ee6c57a8937ab7cc40564b2fd93a30aca4b8de26159

                                  SHA512

                                  6180ce2fe24773a3e42dc72c4b434c7014bfdcb6b578a0bb8018cc70386a82a301ef0473ad75f44dd04590f745879bd31db83cb4668b93bef0c15de6a0698863

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  df87d8bab19b5c096483347323a805d9

                                  SHA1

                                  fc83a95b5d05ddcd69b6c0db9bec7067ba63b9a2

                                  SHA256

                                  f5c4b2b8de20135adf16e69f180d7ad3be7a02b200d0fbcdd88c8c9387847338

                                  SHA512

                                  b45add02e5af6cacd2dc96d4747ce3e88128be92bf234cc4fc912d6e12d3e8ec5991cd38085d3583ed6c0f68dc4b870f327df528ac7d90d4b417ef63b82b7b9e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  31319a3c9344d8e10bd941406ba1ef96

                                  SHA1

                                  73c4f5ff6d94aa60b898865b10d8feeff9f0610e

                                  SHA256

                                  fb445aa581f3e085b92b24891aa15cbb835851976315ab493dac8b230dc9ff33

                                  SHA512

                                  864d6eae1eb08191f9cbaf9c0c73de43ac379a255087beb2bfb4c62c2d406380f7965915450bedc15e07509efbf9e410c327f273620e669b09785853f21c5ba2

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  a7c1a919dccf117c6cda19293d6b4462

                                  SHA1

                                  1dfbb15725c501e93e4f5b9d1c0a7db1a452ab77

                                  SHA256

                                  3d65c674aa9219492fe16d977a48f8a18fc30244f1ce9aa27563056a887eb3d1

                                  SHA512

                                  a1e0d05c72e6267cd737334dca77026cebf74ad0b8df34f75b70923edb3fa760636c1f4319759f77f04bcaeef306fdb9db86d8c217d33c07cbc5654af06d4e94

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  7b5a2326bc5d2e6514d795003f61752b

                                  SHA1

                                  314ee43c7c72322ef09f7f6aedb1fd648b60f2c1

                                  SHA256

                                  c494bfa4bb20bc68f9f7c84d673aa0c637b252ffa42840a49bacdd02cc1b90a7

                                  SHA512

                                  fd4d4e9b9eef48f3966e32c8f5254974890ca760b6aac4733578686d98b14261ef140984e76bf709b48bea9a42c96d52b724eb45ad54bccc73b8c7f9506572e3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  8e84f5a8bf47a55b7ed77afa097adcbe

                                  SHA1

                                  357a9919bc585fa033cd2a7bb58ec4e86c6e7317

                                  SHA256

                                  0ade5afac619a9baf4cf216c59bedf5532f5e1adf60af1355994cd3d6d1d906d

                                  SHA512

                                  42271d8f26cf4439e50ddbd336b9b3d15c8cc2b1bb5f83ad568d13290a68b76071a45354ea6d0a37828321b8ceb2dae69e03c850bd721961a6adb7bd0297f1db

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  72b670c6a0eaa0c485833971103d5111

                                  SHA1

                                  2b7ca3b576166b7760518f3db29690123d667615

                                  SHA256

                                  b89838edf6136b186465832c2b29ec4748d6241088ebcadbbd45c42bee1a9b52

                                  SHA512

                                  6116e5bad0af4d700432826ce00d63a2d103ee1fb2186fed5aee70bd74488f895952611cfcf1b613220602d52260345753a19ba4ae27bffadd86a3699785fef3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  8d3147eeff6562953a0c202f25b2a2aa

                                  SHA1

                                  0521030b713ea3299aaf6c7d4007c0ebba633cd3

                                  SHA256

                                  d9a99252c667d7e2f0509a75649b9dd89f5b2d567a50575bcdd49fd3035be7ff

                                  SHA512

                                  0ef38d1d2c0ca9cddfadc2d55a5c12e6ab847a51d7e6d0d8af2ea2d7cdc69f8baf2dea6ec34a211fc3dd584d72e64698690cd4096c0aa64e3cbaed42cd519478

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  4b6f6614c8d08a96b463062f176a4ffa

                                  SHA1

                                  d5194012bff54b1b87cfb98154fc939f74f16246

                                  SHA256

                                  1be35e9d06f1e9e98de5233a3e67cca152efbd4dbe1f462b5002b53716e88d95

                                  SHA512

                                  84e7ba823936af94c1ea3dc7dcd1034496f746f78ae5407fe5038ae77654256c78b24f2ca04d8214731f612c603c71cab328198287c87f7967d69641431dc1b7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  9298cae2a72eec0957c62d0d542656c7

                                  SHA1

                                  8fd91236724ed473daa5020a80f19e5155caaea6

                                  SHA256

                                  5215f6050ae4c0cf2f089e1bf9e320f76400f172e1f379bb9a48ca97f6f34c55

                                  SHA512

                                  f4a678aebfa7cc2d4301abcb583cbd525939f19b57d07be9d0af90a860e21c9ddaafe2b73367034711d60f46ea7a0b37e1836c07db175db1d2cf0ffcd35e0a69

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  edc5e9a5f7e009036ac86a10d53cdab4

                                  SHA1

                                  bf43e7e237dc68fd9065402d9ff3960fcbf15700

                                  SHA256

                                  71f680a966e184d1120dae949026a108cdf660ef266860f991f8f04d26cfb859

                                  SHA512

                                  beefe1d0c303058dcc91e05ea8b5c9639973a74593aa6c96464e09e2e4297524b60dd4565d3c8ca1bc3d3778d5caf932df22a3cbe5b7c92d58c4777590bb98ba

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  a854d4d32a72ff6c75c0e3226f5b106a

                                  SHA1

                                  4ef0d96ec234ca2a75deb7db615d2d3c363603ad

                                  SHA256

                                  0ab5625e806bac738c54316f4007165bae107d245aaa6ee7310a997fb16ab5bb

                                  SHA512

                                  62fdec4807877dda56effe8d52fc2ec8a650e874f25717406dc6a152975d98d131d5784904ad9476ea1bec0f1a7f4c5a3dcc78d7ec2e9265b178dbbdd391c3d0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  f233c0514a48c29c1979c7c9bfcdaf9f

                                  SHA1

                                  f94a6489e5f9f9168cec7a387009273ceca3daf6

                                  SHA256

                                  6151000f363fc16fc750a845ea3e9b65e598f20b642b18264732b48444489efe

                                  SHA512

                                  5124ff0a287744c29f8b21eaa303a919396ddf6ef8e7df7e06e721e2100eccae5ab647caa3c364a6697c9330270be6f40f551f91ae2a2258b56e178a87570625

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  a1928e905b2cfd5b469a5574823801ff

                                  SHA1

                                  3b8f38d7d42c5973676bce56a700c4f13240e19a

                                  SHA256

                                  7e46b78df870f3daedc45a64dd4a35513aa94535bc7ef7f6423f637592523bca

                                  SHA512

                                  3931cedb4aae10ef6aab95549b2a6e06a4cf6f146434c4d074131d86b344b6b99a5738a497f6b93bffbce60a6cb540586bab8e52db3565355a93b5cb7cdae2c3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  a3370a9a6080cc597de8b8d8f21bc900

                                  SHA1

                                  a32d1dfb3a9efeb0dec0c6b7fa4690f17a9a575a

                                  SHA256

                                  4ace2ebf533084f9428d5f0d33c626e19c7fa0dd91886fb72062ecc1004ec174

                                  SHA512

                                  b0eaf894f40c915a66820dae425c9821e12701667aaea80339f385ec545278b24059adb0ff2844060410901a9d742553f4493190e4959370086b247c5d31b58e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  29ee6d4dd85f4aad002565b00a5ac3f3

                                  SHA1

                                  7e4651751cbeda2e6dcbd77499c4a02a7f1c4284

                                  SHA256

                                  1ce2d0ea4b39b8335501fb576a68812c3c7f047ec2083be2bfd9f99d556eef98

                                  SHA512

                                  97ac180493fbf850c6d65f87c7c66ab44a28b43f157f9132e78b6349df1758c9088595437dc447defd47068fd2a4cf270ea73903055726e1dae96a6bfde77fe7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ab5e.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  8be32bcad964e044a420b7a4ace2b958

                                  SHA1

                                  b476f5c5c7c5d0ee18adb7f06a508c09518f3649

                                  SHA256

                                  8b1829cac420b2e229976c99d5fd55684fb3a70cdb875606cc59720131ff01ae

                                  SHA512

                                  9039d9f1e8e38f4c43ebcd039a96c39b076b96cc8904e9b338bc1c838dbd1eb9df38c0b0c9ce7d96b446148da22a9ba6a7b7a2cb24f845c6ce33753df479ced4

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  09755574115e0a364f3c77aff95a2a6e

                                  SHA1

                                  ecc57b7e278b9679a580bf894325f30ad6b866e5

                                  SHA256

                                  83bedd334f7f584323e7186885eff42d16f5a29a118732bf7c68526c8b511db9

                                  SHA512

                                  ba6571e41914b742f49c28048c3a99f6cd52805ee31f95f3b3ae96bca1e2f170d1a03590030172bfca5a921329c804510d9b723ee5279a07338410324e809c0d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  b0c9e52ab2dbfc09af373bec9720400e

                                  SHA1

                                  589ac23a7588a656bc93ae1fcebb72cb3809bdba

                                  SHA256

                                  e864f46a8fff5e8fb2097ea3e204cc34a85fe184f6b9b0d97e3cdbc88d8fa48f

                                  SHA512

                                  5829736a19c611d5b5d8790d7a0af9083ca114c629459df7438d6a56deaa85b50686446e662ccea5f6e287bc2010b3b5b72acd7646e0a8417a112bbc492f06bb

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  e8f0bfb99562f0ae9c9df0b36b61ad2a

                                  SHA1

                                  e1da0daff63dae07479b32ab1172859b86313e59

                                  SHA256

                                  8679291cf83e65d62193eb8910a47ba128133b04a522f9974af19c211830ddd4

                                  SHA512

                                  1b3732980e82e0eaf5f4b429569e69cb0917000a30478c0af0a61e17abd9b430f7fa3df96f20ece5eb6af3b0688180c7d3482e7849e353a43d99425228bc661b

                                • C:\Users\Admin\Downloads\Epic War 5 Dark Mode easy.swf

                                  Filesize

                                  27.9MB

                                  MD5

                                  0bc53e326ed8fd09c48d56c6f93725bf

                                  SHA1

                                  0958e8277ae25626f8fc9f24a7cacf2b05bab5ba

                                  SHA256

                                  7b503a26edc4ce2255fecdf9fc5100410557f4b24443cb020851a3e25c5ca439

                                  SHA512

                                  33aef1ecc4cf7802ff33d5fd3d032c68d8a047a15a522fb0dcd5b7787b54abbeff3954957fbb41838fdd497b6cf7c8af854a557556862f5428d97e79718220b3

                                • C:\Users\Admin\Downloads\Epic War 5 Dark Mode easy.swf:Zone.Identifier

                                  Filesize

                                  26B

                                  MD5

                                  fbccf14d504b7b2dbcb5a5bda75bd93b

                                  SHA1

                                  d59fc84cdd5217c6cf74785703655f78da6b582b

                                  SHA256

                                  eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                  SHA512

                                  aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98