hxxps://drive[.]google[.]com/drive/folders/10Fnqiyfd6YRekHpK-b8X8l5jeVQKbJvH

Analysis

max time kernel
61s
max time network
64s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
25-11-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/10Fnqiyfd6YRekHpK-b8X8l5jeVQKbJvH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3100	socd_cleaner.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
6	drive.google.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\socd_cleaner.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\socs.conf:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 728990.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\socd_cleaner.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4088	msedge.exe
4088	msedge.exe
388	msedge.exe
388	msedge.exe
1156	identity_helper.exe
1156	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	socd_cleaner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3772	4088	msedge.exe	79
PID 4088 wrote to memory of 3772	4088	msedge.exe	79
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 2792	4088	msedge.exe	80
PID 4088 wrote to memory of 4984	4088	msedge.exe	81
PID 4088 wrote to memory of 4984	4088	msedge.exe	81
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82
PID 4088 wrote to memory of 3076	4088	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/10Fnqiyfd6YRekHpK-b8X8l5jeVQKbJvH
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb36bd3cb8,0x7ffb36bd3cc8,0x7ffb36bd3cd8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,17425832269375567707,17672315041136203242,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4792
- C:\Users\Admin\Downloads\socd_cleaner.exe
  "C:\Users\Admin\Downloads\socd_cleaner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
32KB

MD5
1f76396a01f9b997d149642fa19395bd

SHA1
f26dd69ff0c45d7fcd9553f0cc5caeaf5410cffe

SHA256
c519c5d085e60c32c52df7706f00daddd219415a5aa2c45d2d7d9dad1e5ac849

SHA512
0153e322815e320bbb18042488bffc0bd7a7c6c063c9919284086496c58865e4da89b3606c0f58e1b7c0a07380dddb2e2a59f967966868c21c26670c215064c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f78e24910a4ce5eb2989e2dd42cbfbc2

SHA1
bb7ce5e98f02a7e3b00492d26d8294ac8e19a52c

SHA256
0c93b5a03926b28f66a20d486f146068b7554e2dda6baf0edcc16b652a8a53f1

SHA512
65b5cb42c17d1b17f77a0622c206d925194fc86727d12ded026a32bcc917e37e7613a644e6c72c6d64cfd47b47ce5f5aa22884c2e052ffdd401ea992de32b62e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
797dc3d4c5756ecd19bcb52068442f51

SHA1
720878aceafc1d3ec48900d697a91a586e2631c6

SHA256
d356330df032c9ed669a61cd061954a82e9de67a2c077f73310b11328feed08c

SHA512
285c3d6ae06b2d49b97b014ec122db62f3c3762459d0386061c98b078efc7cffcd78151b8a3ae57102492f2f3e7c578ab9b4434094357677dd1b29d24629cd42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68830e532e34b8221546fad101f97cfa

SHA1
f175835a2a74946cbea546d377e00a4b2be4b11b

SHA256
dd14a605111a4179695504ff6d3ce8d8d955dc9c00425710ab0c825dae1c4b7b

SHA512
c65301238cec0a9b2df55432b67dbdab2ae646fa731a2d5421104c59c943d57bda150d1601dc0d303fdf1c2de7734dc7c39d7084b9fa2bda4008a8cc3611d0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5b5d46dbaf84f3110c83b9ade776ef0

SHA1
57513bd7a044bfd3801ccccf601f3d288790b017

SHA256
e1638dc378028fcdb7052363620bc1757376f0804979badb5df6cc1b0e0a8943

SHA512
ffd6541f7272f8dc885f9e0ba5b8ddd8f025bc37f131f39770d761ec9c12af2cc6f8664e70fd35a5fca52705e74a1d524db89dcacbc9bc432f442469216c0377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5cc94d6f016e2c62c5e90ee4dbe5b616

SHA1
812c3cff59f3285e9187fdbe60f8f98c982df367

SHA256
2c57887c8abf18a5a20987e8a6ee663ffa41aaf265e4d4d11bed2785eb08a55d

SHA512
79509336a8380b1b4d11301b6a1b072eb6d81e1004e2bbae6db54ac63c17112d10265d4c8b58f60f70b55c7994310628c33ea8aafb868c6b32f747fd014a0e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a01ac9f1a045a0c496692995fc76722b

SHA1
2b10fb9b52c0bba1286171812da689ea35d127b9

SHA256
11b3bc8484d21799b830281dffa2cd02effb812398ed9af573116f79be5a079b

SHA512
f8190a5ec36021d8e92e1edeee438b30747f8c3d456307936879a5f5266a9fcbc8272431fbb65c8ffa70a55ebe96bf548e55a76f1234279add0e63c9ffd6a70f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 728990.crdownload

Filesize
152KB

MD5
6d67dac23832cc767751a283ca6ae406

SHA1
7ffcd1ae41ad8837b4e61ed707ec664eb3e07da4

SHA256
713d7ef8cb4d9232551cddd2782b35c5d8b66ea6f550c154928557e780d2505d

SHA512
d296b8b33e35b1b6b2e468c2b5d3845cf2e7059fe6b3c8379621686bed2f38543eed164e919416e1eb1a8121fd981cea3a2a2387dd0736a5b939d0a67c624d40

Download Submit
C:\Users\Admin\Downloads\socd_cleaner.exe:Zone.Identifier

Filesize
186B

MD5
6774801a255dd8021685beed7282d1aa

SHA1
7f30b978cb9305297f1c92059743eed36f1636ad

SHA256
f26897fbe8f61311a4886277ea9e45bc0f69b9466909da1fae7d5212e9b48692

SHA512
dc997c43887284c6a40d2ab5245a6b682d20d91416b4c3b8dd7372247b82f344d10e58f0d85cea0bc8264bce986a8872f88981d81b15f076bb44e6aef0cdd7ba

Download Submit
C:\Users\Admin\Downloads\socd_v008.conf

Filesize
23B

MD5
b3937443ca4a38cb700a86fa9abda71f

SHA1
9f1feed385a2b40b5f8dfc2dc306d0af87e01712

SHA256
a23f32f431234e1e747fe21814f006f6017d629be8341ecfb3636af87c32fd01

SHA512
8305e7da12ce08ff37b764c6e36a9f065b6840dfc5747bfabba8c849943b710c6f130f3490c9fbb7869f08df9a9331b3987c71c98a574e7ba50b822a08cce3c7

Download Submit
C:\Users\Admin\Downloads\socs.conf:Zone.Identifier

Filesize
186B

MD5
56b6c12feabd99b876e1faaf22ab78fa

SHA1
a7f1f1fe04ceb66f75b3478bd75dc82ade1bb552

SHA256
caa02982a4cfbee9c230fb1a24cb927d5319ac56cbb9cd4e0f7014f01d7a633b

SHA512
ff84ed0cd051174cc0128a4ae3923121d693cbb0288bc098c904bb381296b7f79704bd09639ecbbc77347f73ff9c668986ef2195cc9817be4aa9a58f0cc12983

Download Submit