hxxps://github[.]com/ForzaMods/Forza-Mods-AIO

Resubmissions

25/08/2024, 05:06

240825-frdxpaxfnn 6

25/08/2024, 05:03

240825-fpxl1sxeqp 8

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ForzaMods/Forza-Mods-AIO

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	Forza-Mods-AIO.exe

Executes dropped EXE 1 IoCs

pid	Process
4272	Forza-Mods-AIO.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 108058.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2440	msedge.exe
2440	msedge.exe
4160	identity_helper.exe
4160	identity_helper.exe
4688	msedge.exe
4688	msedge.exe
4272	Forza-Mods-AIO.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	Forza-Mods-AIO.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4272	Forza-Mods-AIO.exe
4272	Forza-Mods-AIO.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4656	2440	msedge.exe	84
PID 2440 wrote to memory of 4656	2440	msedge.exe	84
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 4164	2440	msedge.exe	85
PID 2440 wrote to memory of 2236	2440	msedge.exe	86
PID 2440 wrote to memory of 2236	2440	msedge.exe	86
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87
PID 2440 wrote to memory of 5096	2440	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ForzaMods/Forza-Mods-AIO
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c7d46f8,0x7ffc6c7d4708,0x7ffc6c7d4718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,17984751608827590811,12246946709567654394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Users\Admin\Downloads\Forza-Mods-AIO.exe
  "C:\Users\Admin\Downloads\Forza-Mods-AIO.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
644d39e67e419ac959e1e8500a84865c

SHA1
32fe6663f123322e54664077ddbb239bb4997429

SHA256
6723981a90934310b9441b9b5c0710c93783b44147a1210c31256d40570499bd

SHA512
74d08b16f49b58d27d7703dba5a6c1fa9390cf518778de50331b0a5ef92b3f53f43442e15ab178793043efc6285167480d8850939221b6f02b566871c150dd68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a267870def722843498c9ddcd7672466

SHA1
e0c382613029d18a42583a9473b4677fb2376acc

SHA256
30f03018a56764a8a84e362ba68b213785499cf0d3da0e7dd2a685f4459a3ad0

SHA512
8313721361942d7c21355592f79ea3b74c83077c30b1a809ad4ed94009c92cbefced8e5393e6219c7eeab95561bf5b6142a257750b9f37a8d7479d625405e2a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
567B

MD5
2fce420e0f5a49cbdfa3c4b1dbf09c6c

SHA1
db85fe3d5ec05374189b3af8b717a1151a8e51f6

SHA256
fd82d7be06f2f7e1f6b542c5258231376d5fcf1c7fcd2c9ec87f63943fdd0c54

SHA512
8663e8db026e87babe170f4dbb123d7ca7727d1a4e56453f4f8b45ed461ebd1d3b0d4d8fa13652de9584e0a68429b7863640fcd8e49324fa2ac6f66e718198ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
861963e2efc7e9045339e22cb5596a05

SHA1
fe46acca184dd5e939ba04e45bca98ae7e8d141d

SHA256
114df010981252fdaaaff50a1c3d796a488c5e06602159f801b88bf4b849e3a8

SHA512
46758565afcce424db683d91e18f5f148a31c09e70afb39f50e333b60d099bfd8cf2068a17e502421a6df8c4ecf64a86d6617943c4dc267c6a06697b3c1709f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c22101518740547a56d705a54cb8fa27

SHA1
2dd4f219fc12a1cac835480d7ac85be8fe3a2601

SHA256
36d5a98638bcb6927cc4f30603e05abd716ed507d16d250319c4adc0cd039c76

SHA512
e617654e352d60c21980f996dafc8415875e7ea1e7f2e1fa532ec8b08947d9a5cc10b89c557af2482ce40502f5337858df2f59e4c2d38541bb2408514c122cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ed7f30b86753d5b3291fd52b119f99e

SHA1
53e8463b43588fdf17bb4e3e6fe1eaa6d76d42f3

SHA256
1236ecd6062357fe0971ac832471ed79b42478618d577633320dd38a9c5ad810

SHA512
075dcc839edbadaf6687d264279b6ca788c222d5833db36eedebc7a3383c3a3f3d627ecbd70a1d32cff5b49644b25a8e621e4d80ddbda575fcffc6729d51e7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
184d9d2be6bd0b4665c8206ed7ea5d72

SHA1
954798aec425c1b29bcc9154eb577072b189ff2d

SHA256
8662b76913146353ec358c3b10b6cdca7119d416d38da4916c53ba141b6c9f9b

SHA512
4c47b198282514a2f26cc2da06bd0cde21a332bdca0edd90c219941190f09ddf5d219241ddcb94900a8ed6e57730671e146c72cd1f972b1f9875f5db9ef9bade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02eba817ff98c7033c4bb68384e3a6ab

SHA1
da692fe2b7559e4ccb56701892fd56e42c0bdb33

SHA256
cd1158619a73994862c6908b2b9c608e805764c67185c24528d86f77a8138a5e

SHA512
ac830adfab19db58722224da5f5bea3d8dbe814166741ebf0d7dd5455ca9bc241bc4c4cb9c9086e42960ca20871b2eadae04b829754479203a96051c3d524b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f0e8.TMP

Filesize
874B

MD5
449cd009283ca9a66973b0579524cf3e

SHA1
34ec0bd2c92f4bcb68c474b734436f363e7085d3

SHA256
b96095099cb62a8d2821a83bd8609015bb51f6c220bf1cff478eabf4b5cf1e95

SHA512
52561389077f51b8e38a87047f06b992721d0b330a2f4172a4fd7e53e1ab294cf074e5b10ab48f33dafded95b11d476f6414e508707b5ea48fd589c7f2794633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f3af59380d9b8fe38cec7ba460e3576c

SHA1
2d17b682c94df51958f06b14ce97639c2599039e

SHA256
8b23a6705145df513f9cbb2b1507eb14688c9e5cebf050078a297eb446f49261

SHA512
5f0b3ffd7f7b336d453815a616b13bc76e215e135b665458699e0be40a80755e1817aaa2a3bc6ec9381bbdf43340f23ca10280940a85a79e146fad69724f3a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
323900c1d90592d4d7c9fcfbd3805284

SHA1
c11a0d22a19d3adfe4337931aeb1a97aba585bb6

SHA256
cd5ca2711ef82a1650b1ee885bc305b1d89eebda7e90011124fa581ecd41bc99

SHA512
26b672a240014c8e64987d52599b9415e6d461f774d264d6466aa6122c14e1d81acc6a7a94658434f1c6030ae52732a3eb4dbaf638497df5c443d889878fdd25

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 108058.crdownload

Filesize
9.2MB

MD5
195ff40538d94cb4b2fd07eac975af1e

SHA1
8fabef2156ac42d47bec2b45f5708d68bd1127d1

SHA256
16b34533718049f776521fd5eb9e1ac9269022df881182698d213a7b4fbf0d77

SHA512
2da1d8b62bf60c0f62c9947b02088a63153a35d8efa7f3de62059a18a114f8530efe7f6967c040891326595fd16aa3c11a074ae800dc2d8507c56004f3b68207

Download Submit