hxxps://github[.]com/pankoza2-pl/trichloromethane[.]exe-Malware/tree/main

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/trichloromethane.exe-Malware/tree/main

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2504	trichloromethane-safety.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
54	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trichloromethane-safety.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 110237.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
5116	msedge.exe
5116	msedge.exe
452	identity_helper.exe
452	identity_helper.exe
932	msedge.exe
932	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4968	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4968	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 488	5116	msedge.exe	83
PID 5116 wrote to memory of 488	5116	msedge.exe	83
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 4824	5116	msedge.exe	84
PID 5116 wrote to memory of 3380	5116	msedge.exe	85
PID 5116 wrote to memory of 3380	5116	msedge.exe	85
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86
PID 5116 wrote to memory of 4624	5116	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/trichloromethane.exe-Malware/tree/main
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb114646f8,0x7ffb11464708,0x7ffb11464718
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Users\Admin\Downloads\trichloromethane-safety.exe
  "C:\Users\Admin\Downloads\trichloromethane-safety.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18304192747339328096,5549670086893296725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c0 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
baf106eb2b6eccc72483e9338283c65c

SHA1
8bfa9c77bf077c37c1d6165120dd9dd850a92075

SHA256
888b06ae614e8cedf580ba7690962990972eaa8bfeb134fb31830b50f9ddd6ec

SHA512
2d4657572640ab695a3e80dfc3d1d664e1e014b3632725cafb05d0362a8cc532761fc31cd1543ea875c25911213e531a75c5c9a19b51341f55ec854b08e1a677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2271c00b5f9203160041d382d81742f

SHA1
e5370f698b2ea637ff83ad5bbe796d00813640c5

SHA256
3eeecba10976428e6d5a2d0c7228e08f125a6f3643a47c497867fadb81876e76

SHA512
2d7f792683ec146c2122bfffb9675228bd1fb8f500a6b3c3ebbf631db8a43b0d1ea542a57918befe6a1b3e71b0539ec1fdfb76fea4b27063c9766ff6770322cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3808bb8afed853a6568c38e9ca6f63ee

SHA1
6786f5690616cebed2bfb1e05985e339a001667e

SHA256
1a40fdf0e2db1fda3e1c480b3924fb8a1d0fd0c96c4993cb8e6e3d67726624b9

SHA512
c242e92586bd7fb491b49acef731ac320c2b05ea356f3912e0ff6c61da950af88f2d0d2404e398f95d1346385d44bb01a1174cbbd642180df83266e838abe7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1b34f59293dd9e9b2664db34ad2c3b3

SHA1
2afec705434d47e47bbefdf302abff0c299834d5

SHA256
d8c7e3fc9df608723ca92957b80efe59b980fde998b80dd8cdf95d5bea14ad7a

SHA512
a642f36884bd2b4952a17ba2501d0858c04cdb4a3cc74fbc9cbac5a1489b0cdadaa211d493b8d2f43e28a273990e394e2bf0cfb9a7c4e07d49bfed571558bbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96c45308cfa45f0de0c146ff2f38f44d

SHA1
e0281c5296dd15010ab6f340a09f80d0f5e2ec1b

SHA256
ee7ca1399e60f7ef31a2e32c2a613ca87a914a60ff619fce81bb76ed137833e3

SHA512
a8f552918bf5de6c0106e87c2e44acd1d2b4fefa77e7a7e8afb42daeabbed4ea64a581f30377612b52f6ab50a8d22a6f30bce2cbb2af0beea6fae3cc92eab0ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f8da6dcf378d5b7f90afa1ec14f3771

SHA1
a5b8863c235d2598b8ef76435d3ea722b533d61c

SHA256
394c73df25e44a9de12b971519619b555b6ca964edd020e9ff80479d695920ea

SHA512
1e911edc4279b75443377dc2063265d3bc1e1a4ee61c20ad905064ccccb584c1decb224834b69ee7da0e38e3ff53158896be738358ea5a920f09fcb64dd6de34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa2ab6cc8a2155c9d7c8f9fe7d6ccbba

SHA1
750bb402eb0712e3bcf0d8d69c21647b114c2a6b

SHA256
c09659612e9ae12e93932432bd125a412ddf715cbb75723342d65b4d843a16f2

SHA512
c5a72b54fa565c08c9d60c43c33f6068807010c0b91f5d30fa5d90b659374dc55bea6cbb17a153b84c3598381908624c620c5b33251bfccbf132c8bd9912d325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e474.TMP

Filesize
1KB

MD5
1fbfb9e976467e2862ae8141d1ddb9ca

SHA1
8079d179d4a09c4a27297a3097cb0774d693a1a6

SHA256
4c2ea7876a60af0a9bdb18414ae7416a34f10c266931debaceb8827ef46d380e

SHA512
a084d1347b876774942eda232587421734bd1a2d11e8bebe03d14b5c09955c6dc85f6243fd5b4775cb010114ac6babedfd31bef7e89ad36e7490060ba0e209b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8091274f56c0e34334fd2bc6572465e2

SHA1
97ba48341afec54461d7302d1e2b1c88aa700846

SHA256
4a586f3fd38e8ddb4232a3ead755f82c9870be3a7a7c7be39173ead56afd7ed5

SHA512
80f0d72365f5ae6a5ad40a48de6f650acb071adaa48d01eb2c71be6ae630dc183fa334a79d8254be28d735bb14c9bac07f01e8e2f3f2ab4425b42d9a8b7becd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a6adc5e748655216637d69e67948e99b

SHA1
752133c9ddc728930feb193f16144a4e0b3bf942

SHA256
7414649d3c884e7d65f4147bb9006b16c06b61b314f7df7fd633f1f0a5fca099

SHA512
c942750f970c03a906353841096049d16a1355ad4c7f07fd041c817459c160173d9dc66dea691710062d40e57a33182859b82a3341f04ae9dcf27074f01dc53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
89bb4dca0c78838d58ccac4f93a63544

SHA1
0f856f9f47e24276571f848b8f6d51a9f65e9793

SHA256
a8b2d46a4989466e575067822a70d7ed5d9d5caf3c8957579a0d82f5778fd831

SHA512
7ec05ab3d25936ee7ddb99e9ecec664772f000700e1ad9eded3d4e8c2220376bb05cf16fd1322fb6ccaddc1b435d8110096e240c30bf5d2ac08eab85d24b6ff2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 110237.crdownload

Filesize
83KB

MD5
1453f56916c0ea96b9ba5b49f09757e2

SHA1
3e25edc13b69e5db4769f061f586e42b812996bf

SHA256
da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b

SHA512
37febf9c7bd3f35b45de356e8dc92a9bd5e065471669cb9afdb7048308df0c852b3cbfc5f2a3cab2887d67c9dab4f2fb2bb21ee9de42d13b700784367d1f8ca6

Download Submit