hxxps://cdn[.]discordapp[.]com/attachments/1256344855244836884/1269304895664689232/persona_1[.]zip?ex=66dd0f8d&is=66dbbe0d&hm=cb7a8746139d069d03ffcc9dd3861d4effd6852788b9e791126ea3d50698e7fc&

Resubmissions

07/09/2024, 07:16

240907-h3slbs1fnm 3

07/09/2024, 07:15

240907-h3edps1flr 3

07/09/2024, 07:12

240907-h1m8ts1glf 4

07/09/2024, 07:03

240907-hvjnfs1eka 3

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/09/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1256344855244836884/1269304895664689232/persona_1.zip?ex=66dd0f8d&is=66dbbe0d&hm=cb7a8746139d069d03ffcc9dd3861d4effd6852788b9e791126ea3d50698e7fc&

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\persona (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\persona (1) (1).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4264	msedge.exe
4264	msedge.exe
4772	msedge.exe
4772	msedge.exe
4964	identity_helper.exe
4964	identity_helper.exe
5276	msedge.exe
5276	msedge.exe
6080	msedge.exe
6080	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5492	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	MiniSearchHost.exe
5492	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2452	4264	msedge.exe	81
PID 4264 wrote to memory of 2452	4264	msedge.exe	81
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 3608	4264	msedge.exe	82
PID 4264 wrote to memory of 4040	4264	msedge.exe	83
PID 4264 wrote to memory of 4040	4264	msedge.exe	83
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84
PID 4264 wrote to memory of 3828	4264	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1256344855244836884/1269304895664689232/persona_1.zip?ex=66dd0f8d&is=66dbbe0d&hm=cb7a8746139d069d03ffcc9dd3861d4effd6852788b9e791126ea3d50698e7fc&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffffbc03cb8,0x7ffffbc03cc8,0x7ffffbc03cd8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,8228596024609248162,7313574718636387290,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3300

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1464

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5492

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4ac672147b6bf698338479009fdb122f

SHA1
6338784fb3fcbcff454cacd2d49adcf51e542302

SHA256
611708ffa1b3717c742d765e04c68d21e52123c1974d11f2c2a6056b6373f035

SHA512
1e98cefbaa3ceda75eda18d9bee3adc236c8efedff6ba52e92d47d883a0b76693d9c20c13b70ded7f93d04848204dfa91c0d5113d2fd239f4b174ddbf56f1c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ed6fcdaccbc44222f02c1749b5912d0

SHA1
d7f2cff2dd64a08503c4b8685d04d5b0111495f4

SHA256
210e79090c8af6994fd7a543329b96cfcdbb60f50c5b51a24346d2169804852b

SHA512
caea38085acf2b992a70df2611c3bcc2dfb8952bc28a059de5fe988152c763e39cc5b211edbdc78dfe0edf1d8e8c91b3ff356a11f8a7b878bcec944b269d52ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1061dc87679641412f921b14fd7b2d63

SHA1
a02ef0af874f9859648d7618bc110558e3fd06d3

SHA256
df86dd787a704a2280cccb771002cb509c26684772a971e0c367e53540bd7d52

SHA512
7a08a4adc9077781ae56676ea70b8a19753242ea6b98bfec6fc952d94a82e668761e062b791ceaedc43b9c5d14d2927e455ac8c93f5ef809f5eb88c3426031af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
caca5923137c8bf2eac08c7b5b2dccfd

SHA1
65ced27ed3c61347171db8043150414f71630dff

SHA256
0eceb396e11dc799d8d7eef22d65c9af0d74ecaa8eef9d1b57e6b83565b931da

SHA512
33a718bc8584edbae8d6d44b7ffb5e7aea9c4635ca68558ccf5ed98cc60964f3c435ea3ce439afaf41044d4f93b0cbf29be39a711ed9e0d43fd119318cf19adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
074c97bdf841cf743561d73b9f612bd4

SHA1
ab3054b2555bf1f25db2a2ec1f1383e4b4ccf3d2

SHA256
ea53febd1667f118ee03028d043c7f5119bf59e195c18cbb308f5727a6bb0125

SHA512
b4da709b4e98751a612eb2348392ea03fc7a746c0c292eb70f7404024eb60e8ae02929d22dc39d9680c9bb69b5f8de7a8fff26345ed64c9d81a6a61ae9cd2617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba143a0e6370cad79f15376e00e58c8f

SHA1
5b28ec8d5e8c1fcc7398e47c012b8c4c60a57931

SHA256
a632afa4fa20b52ce8b3e004237b87b0238c50ee93d2a6245d9591ecdab9d5ce

SHA512
36ce3b6a22cbd7149067ef589365f27c8a74244e2f8370b053a6dd8e1f97dbbb59c024e88e3a4ce7244178fc68ea864e84910cbd8508f6cb69ed0744e8e268ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-9-7.712.4044.1.odl

Filesize
706B

MD5
736be25078ec3c48cb2c501cbb98a391

SHA1
a70aefc6a0cedae6159146571310fceabef28f8c

SHA256
a4aca31edd3f01dc3fd503495b2a494caf179eef98c647ddf3598ac0ff16cd96

SHA512
f76ad97d42e3af4a048ad325a2160f4ec56bb77161b3910a211c6b8443faa30480a13a12214cfdcbf6518a75fb0df600a9b2c2cf73b10cd3b01aa07d6da080a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a7f391566ceb7d310b04c1376aa66a07

SHA1
eda88e9134d3de209152481c9e8aa02054d4c2eb

SHA256
8ecb81fa22792fa6bb09abc86b9b5afb50773e2c5537def45dd8ba297f6c714e

SHA512
163bad20eaa9108286367367e6a54a9ac612026954ee2466b8f88f732a992695fe160d3fb5f092976ef15c1c1b71400e577a9a4833dfa616d7c9ee6a8237033c

Download Submit
C:\Users\Admin\Downloads\persona (1).zip

Filesize
1.6MB

MD5
eb622d1d6f5e01f449b8d62cd4582901

SHA1
93853a1b984a8e81b9aede0917043286cca387b9

SHA256
8e6396108c150914c658d7752b97da9f495d05af25d7b0c7270e3b4aefdcb639

SHA512
1ab08584b411a9df0c491973365149cece74b9bc3a85bd7b0d872449cdcd7dba941c42d2efa9778670c8f5af703b3df6eab7bbe0e2064f5bdca4eb676bea45d8

Download Submit
C:\Users\Admin\Downloads\persona (1).zip:Zone.Identifier

Filesize
221B

MD5
7eb01d98d3b50c62711dee3cbdd8b26a

SHA1
491cf2cb740e2009a5de89913b5a08935fa757c1

SHA256
9dd9d78e69790e30cc9b9aba22e90e33290f6bb5880d1ba5cf09ca85cd8a6d9b

SHA512
2433b9bb64c55f11be107974a6b14ec59ae26e9ad97015fb629238c3cfeff7b8ed129147e877c345c1f144ad44580cf7c18738086f27e8be42937baf2bfa995c

Download Submit