hxxps://gofile[.]io/d/szsKCs

Analysis

max time kernel
600s
max time network
426s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/szsKCs

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1944	Agent Client Injector.exe
5688	Agent Client Injector.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\BepInEx\plugins\AgentClient.dll	Agent Client Injector.exe
File created	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\BepInEx\plugins\AgentClient.dll	Agent Client Injector.exe
File created	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\BepInEx\plugins\GtagModMenuTemplate.dll	Agent Client Injector.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\BepInEx\plugins\GtagModMenuTemplate.dll	Agent Client Injector.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5644	1944	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agent Client Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agent Client Injector.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 51911.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3308	msedge.exe
3308	msedge.exe
768	identity_helper.exe
768	identity_helper.exe
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
1944	Agent Client Injector.exe
5688	Agent Client Injector.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2324	3308	msedge.exe	83
PID 3308 wrote to memory of 2324	3308	msedge.exe	83
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 2724	3308	msedge.exe	84
PID 3308 wrote to memory of 3756	3308	msedge.exe	85
PID 3308 wrote to memory of 3756	3308	msedge.exe	85
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86
PID 3308 wrote to memory of 1044	3308	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/szsKCs
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb53e546f8,0x7ffb53e54708,0x7ffb53e54718
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Users\Admin\Downloads\Agent Client Injector.exe
  "C:\Users\Admin\Downloads\Agent Client Injector.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1312
    3⤵
    - Program crash
    PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7081879086214152415,9679484353829089732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5212
- C:\Users\Admin\Downloads\Agent Client Injector.exe
  "C:\Users\Admin\Downloads\Agent Client Injector.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1944 -ip 1944
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
9b5c51e2dc8eccb09fc4bf4821d8dcf3

SHA1
e6bd904e16f0361522d14a852613fac32c5a3dcc

SHA256
bb329a400292f29a6ebbcc420eda19b20ec5182483ceb8a3486fe61ffec5772f

SHA512
8cb079f4de4d6e9f1650cedf40105e855942daadd757d4a9c80cb0009d546895a27724e613db0c1fc0246c3aa5bb74632cbf557c21e61635898eec14950792a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
5f05b26e0caccbee54089cb0044220cc

SHA1
e76ead734684a93a820d05c76824d5445f28f584

SHA256
256bcc760870f0a18774ed0999652be257776a2049eba989bda8f359b1507dcc

SHA512
29ecfa0586aaf62f2e6a90d2623fb01c7bb156993f2ed00085d8dcc97026b48aad69f27855cf3231d6f3d5c388a81367ec9e27ea47cefd50c530d08862292dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65f0a969643e9297f2c6599140c76c0d

SHA1
ab735410e98962f563de70b394ef5e9cb55c140e

SHA256
f65cefecbc7dcc60c9e5473afd2a5b76ea04f5117899f37a036d769d6ced3ef2

SHA512
fcfbbb56c4fcd1a5834cead7f6cd463d67c52ded0dfa2e0425d590b7e0b5a74fd25a54de587be8f83d435a16a25114bb3e9ee848435cba99c03bb0e3ae96814b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfeeaeed76785c97facb3c93a3c2cda3

SHA1
2af0458b4ad7aa59374aef81fae372feb5113451

SHA256
5aec9a8d2030d13de0b645f232534b5c803245a65afe05646a23437530ec18a6

SHA512
563f26f1396ac3e1ce35edb8b908ddf43b2ef91710b17e262cf7cea14a935fc9b414ff47bcdcf338ec8bfb54c3f2deb4450e5780ee7b5650b3252d4abe510b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddaabbdb417db954cc73001cc6f74cb5

SHA1
6ed5505ef5b1e21e7fb4ccf1e413c11dee63315c

SHA256
47970e55460e7802819e422fddbdddf127855e1b452627754262b224b04c889a

SHA512
53e60cf508e0cacce039629c6d36edf5f0973038c6bd48e57c14ddb3f494bca10c0a0153e76371d504edee78b7748c178e7a1c3a820ac5070f377c4849fe6f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc1313e184f814959e36b4a0c9ebef19

SHA1
5e7bab09408479f32ef0967e1e970d2b5c8e8189

SHA256
6107314164f9936772a9344d7168544ac64f6ad687a39f393a9f675c701a7c1f

SHA512
cdcfc462bf8f81474035a8340c017fc5def2c82b0f7ffa691b0779ab5d1cc976cbe60530d1f53a982b97008cb64cea7ecd62c5f3c9bd639e3882f48662519dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6a636d3e87ae43cdd63e7cac5e9fd590

SHA1
031c2dcd6c4eac7159acafa72c5f77827169f485

SHA256
05a369944c77c9c414d7af19cd8c69e706dc0fad0844e7205d8652ad44b4a3ad

SHA512
b391fc43a9d9f09f367c822e930b0cfe8d4b752349d967b2bdc5794928b1b4f021297912079b7f5659687ed723cde9e7fa12aee29797abf67c970a21dee2535b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d5110a2182ff3791782df33ba4cb3cb3

SHA1
2ba5dcd5c8e0f59a3d37818cb38695841bcfc734

SHA256
9c7522ab82e65c3489ba171037056d9895e8d404ba501105bb473c215a57e438

SHA512
b79bea6a24fbd7c7c3219f79d600deb43cf0d293afac3d5ab3e09f3a6115884a3765c1d868e3cd4213f3f333aaaf58c357a3f3f93d83a345cf0bbc43e8fb5262

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 51911.crdownload

Filesize
78KB

MD5
c6cdf723174e563cebeebaeeb343e627

SHA1
4ecb56316ab5673e015a33d209fa25920a37864e

SHA256
6de435d79de123018af31a1ec44b3761be4fa11f97639b6455437b9cca01ffec

SHA512
14e6388c7576919d5a92afe891abe611e063d9a29c3cbafffa93d8eee048ee80cb018b452b0139f0c01ef804eb26e265fa805921a921f684adb638f7356b33be

Download Submit
memory/1944-119-0x0000000000EC0000-0x0000000000EDA000-memory.dmp

Filesize
104KB

Download
memory/1944-120-0x0000000005D60000-0x0000000006304000-memory.dmp

Filesize
5.6MB

Download
memory/1944-121-0x00000000057B0000-0x0000000005842000-memory.dmp

Filesize
584KB

Download
memory/1944-122-0x0000000005750000-0x000000000575A000-memory.dmp

Filesize
40KB

Download