hxxps://www[.]mediafire[.]com/folder/vnkr1egpyh3vm/Driver+Booster+Pro

Resubmissions

05-10-2024 21:06

241005-zx53xasfrq 10

05-10-2024 20:43

241005-zhmm1sxanc 3

Analysis

max time kernel
1499s
max time network
1501s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-10-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/vnkr1egpyh3vm/Driver+Booster+Pro

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2832	msedge.exe
2832	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4112	2832	msedge.exe	78
PID 2832 wrote to memory of 4112	2832	msedge.exe	78
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2008	2832	msedge.exe	79
PID 2832 wrote to memory of 2524	2832	msedge.exe	80
PID 2832 wrote to memory of 2524	2832	msedge.exe	80
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81
PID 2832 wrote to memory of 4840	2832	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/vnkr1egpyh3vm/Driver+Booster+Pro
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa985c3cb8,0x7ffa985c3cc8,0x7ffa985c3cd8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,3800745789885048099,11458276705142246665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f205911ca9e0d2ddd0b58feab1b1cf42

SHA1
4c93102df4ccff2204bf2ff2ff132c168fd7eb33

SHA256
1bbef25c650ad2d21c4eb4deb49eec90bc3f6268bda017604ed14cbae436dcf9

SHA512
51b9cf7abd03cfb6ea62434434fe3ea2290b27655a148c831465f00fad975599d617415b590e206f483c64d23512462c6f49ee6cc09ebc5a82c3550f40c81ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
27c9ee07b9643464aed7a7b2447af557

SHA1
9513386d1ea259fcb2f29baabea5aa7377b7fec7

SHA256
1a3d9994b369d0eac227cf79a20ce817a829e4e035486921c8d202890ad6ecc8

SHA512
c2ad56be05daebf590dbf859c72798262be8b373b954f01cca3f78ff1c81b480832f222a43474a9e269d8412a79c633e8374c389873c935496bc737057a8afe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1256ff946e0db76aa7bd900e4c9e1143

SHA1
687f1cea54eff3f49706ba75c9116a564c496132

SHA256
fc7d293a461f77b8ca47f6a747c7651353aca03130a659901bd50194f48e9ebd

SHA512
342452405c9448e6331165d6d9b72cc522b8792467fa36b60586365239ef364fb6daba95c7bd7c9e33034462bb47b44ed560395d637e12a93ad76296375d7c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c35d657485582c4bd3e494f28de3e6aa

SHA1
973a5338fbfbed8edc7d12b4a707eae7a4c0acc7

SHA256
808977dfd0db4610b6119842f4ecaa4bc986cdf61cd9f2bc14c747aa604ddd02

SHA512
1c5fd16182da87994eea92ff587a71a2f3f14fef852a4421bd152b0b071d9ffa863c51d8dee60fbfdcea08cb98f8025becca039c08ab2be864025b110731378d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3ea8df5dfebd251f8a4ca2f029dad297

SHA1
b0d4236ceed0b906d06dba55e3894507b3521100

SHA256
3c751e8963981495f3e66597ee418c3326b2b686f6ff19758d47cc0191661431

SHA512
00151e238abf0beb61fc92c88c401deb063a14167c0d5806f8fd971d0f760b3090d377e8bac13e7c098061fd25141b31fe8c097cbbb5cdfc6b85fb925fd38e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cffbb6a5445baf73071e6a27b1f68333

SHA1
9035320d7061a2a12bdf24f3b9ea48c56407e55f

SHA256
2fb26f16ce55b5e97c5ebabe88418649d516b33d582344bb7c93e6b4f61d897c

SHA512
390d07fd0d430f9f06377d41f0ed5655d8ca4889210fe3f3e429ef7813e8831daaf3273ba2215e0d552f7ad1b909a6477db0bb01aa0e86af82ca7a1ee37ee5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b03.TMP

Filesize
1KB

MD5
14cdb416b2adbde55ddca80eb719ef90

SHA1
3d934c69da9f2ec44412abef11339099da7ca9d0

SHA256
9f60bf9ea566f7fad5352ccfcc0fa6b2b7e6e4a9b3cdf75ad5b758f00d9c5720

SHA512
6923c501008a22b2e640407ff63080be466b6d3e90dd1a2d0caeaa4bae16c011dad6e3fa009dd09fb577313ba7de710b6c11c21ffb26beacca83260a3a8ac96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9ab17559b10226bb2e02b35f9127a855

SHA1
ff8ba54241b99d12517224578fe5767f2fe56ab9

SHA256
c23acc28a758fb834058b710b96071418a023e1b7fae82a66b0f9ed628fa94dd

SHA512
5d2220bc5d41a4920ca3e54f062067de472a2deff022e7f1c8504a29748f05e9fd6593efc3df49226e05adf5f1531720f443b9972fc84c42b610e7cd97cf5ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3f5886abdc08b9d1bde007ce671fbfec

SHA1
414a9b6bfebb934c6b82edd9e5615f69922d3781

SHA256
4becac8152775b7c7a0268cc28fe29a418dea5c6bdc92ad54373872aa8d8c14c

SHA512
2446a3e497648d9db97f57a116fbd781c427855c61e45168e0915ee8f474ba417695b975dcf45b397629bc72603496767c10b5a71025b4b0d43af942334127ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f895b997146895908b9dc3c103a5324

SHA1
b90bf827339adbc7034a100b7a6da02be1ea23fa

SHA256
fe8d7807b935238824c98537d7b2212ab79e4ea20449e663d44b5fda6a615080

SHA512
ee0f9d6cdcbf3b93aae7c0472e7a5429ffca4a528a97ada90ec616081e9e5aa89ef6ffe4635baa239972d30cb1c7aa66d46ecd1b43d0587d7f76889184f00c41

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 460513.crdownload

Filesize
816KB

MD5
2920e75e84ceb4c33d160b67126f9541

SHA1
544dde955ba888055fb0a01533301abaeee0c3d2

SHA256
5e935a2dff27d3857be5de46249b1bc588f2714e065dc5456863301976a34db6

SHA512
1db76fcfb1468bd51318944c4d2b4efa38f0c7bb82e3a2d2b9050bd1be665a1d64f47b7289a1d932f5d81a68e58b79dd0fe689dfec42847f17c48ba5566884c9

Download Submit