hxxps://drive[.]google[.]com/file/d/1QUAiuz2O64llSNMg_JzUFDwFzD9si9ac/view?pli=1

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-11-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1QUAiuz2O64llSNMg_JzUFDwFzD9si9ac/view?pli=1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
1	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\error408(Fixed).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
4880	msedge.exe
4880	msedge.exe
564	msedge.exe
564	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
3960	msedge.exe
3960	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3716	4880	msedge.exe	77
PID 4880 wrote to memory of 3716	4880	msedge.exe	77
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 1140	4880	msedge.exe	78
PID 4880 wrote to memory of 2932	4880	msedge.exe	79
PID 4880 wrote to memory of 2932	4880	msedge.exe	79
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80
PID 4880 wrote to memory of 2876	4880	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1QUAiuz2O64llSNMg_JzUFDwFzD9si9ac/view?pli=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f42c3cb8,0x7ff8f42c3cc8,0x7ff8f42c3cd8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1660 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13294482043833510851,5539159003099270272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
727a74f39945c9406ac9513aac6cf2c4

SHA1
4d4aa82a1dd8916c8473ae6f62754b363a9fb539

SHA256
4a781ac6b57a2bd2dd8a63cd97d2e9be31a96a6d3a02a474cd00509d8d425acf

SHA512
db18edf213b6a6bdffecad68645b6a4c2fc0ff17caea0c8701e45ec94aa0690e113e0ab9f586151ae272dd666c09ea6043bf7f3c6d05ff5a54503af9f17c758b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
af175ad6b75ede406790bb8a06e3f390

SHA1
75f29adb9963864493ff187e9fdac847d0b5602a

SHA256
327ccef45e662dc8aea0642333d8e842039b5ffdaefb9ebaf2bc61604f3a2dd7

SHA512
658585816b986b7fbf6da7ef859c79f57c004c451d8f01be6857a0582bad0832e3bbbb9cc61165289f91f1df2d7852269151006060ec9565afd7645d8fb58a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
46b7137c96e782a892fcb1fe80056e5a

SHA1
841ff62333da4312b6326d3f6168cdb64ee42664

SHA256
e8d14728bb5b7dd5d812b2e0ee9fc2d4ea1aa87d9b5166160ac63066c1daa619

SHA512
fc93e6d263bc5691fc2b22bba92460628be1d4ed7e3e39c725beb245e42f797571364566be0fd10cd7f2b275959f58fe4de5d6679fe6b625e599f14c8d943ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d677802048f1ecabba54ceb61038c88

SHA1
dd5a73aa180a46944d24d2cca1654eb9ac27d67a

SHA256
d7bbfd0809478f14683b2bd597bf1cfcddc1b07fa5a4e4df0d5bfd5d37566efd

SHA512
65bf9959fa508ad37122b1ad3f48a263819afde398d89fcb8f7b0a9cb6bbc84df3f9799a854e415636c7f9e9de93378b9cfcc6861796cffb81ac9b26a88305a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15d319b882ec73d238643ee48ece5667

SHA1
780f9dff870f8c851ec84577948ca7cbd931d808

SHA256
baa17b8acee17f386486e5a741439f9061ca92c749f1dd4f178c4acafab060dd

SHA512
e8d48b01a2b589f18c37149edc4af2732d234f37b50042a806e819d85e450ef59a8c4aa6ea726f764f7e1047fcc384387f5ad5d3f72ce83a02c1a399f19f2812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17928d92f2460d3a13fe287443ac2d43

SHA1
a8cde4eace747a87ba203a5c5de347970c0af311

SHA256
f0ec3e85cd16ad87a68614d27b3410bf3d52afd9e8f6b037003217cf958d8382

SHA512
8df3556750c350da11367df4e505583cdd99230e047f2ef97ba9857ef246c64cb6ed33f1a56e02c8f28dd854ad4ea953e0a242e3242fdbcd209101df220dc341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbc3e67a5f356c4f38b5df4c0c11ae9a

SHA1
1f5fba0858fda02aada405e5398860a1bcc46699

SHA256
53c77143fde065f241a0f235affc372166f12624c3e74630861ecfa24784c9fa

SHA512
50c0b0d9474dc354f211a36bc53a91ab6e1f6dd0b35c8264b8bdfdc86d575ab7714937475ea2fb5c47d4a317366e94b04c90345f1bde61b6bda7cf09ed64125f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df136c9a45280ae5281ad274633f4501

SHA1
63f59e21685409436fb9d50e9d0ec62f0bee1545

SHA256
0d191c588ee5f7eabee6f085d07be31e31cafa6977522596c507f0ce5a53389b

SHA512
785af122ded8f0300b8c62adf558bbb8d521e8bb345c4bf5061e5fa3352490db91b93dbf688c10e65ab9aa9943ea703bdfe39aef3b4a21a68c0465f585bdd963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7a86aae2a066031dc4f9d819e20d8fd

SHA1
2de78c0c0a82c0060d5d8f5a9dd01df49557ab14

SHA256
6988ab7b0d171ed0b2865e3dbb17d37e2ddbc84c9c8d458bb475573f29218f42

SHA512
cb735d5d4a4afe63948ff5edd7a0c21ffb4ef8e4334e1ccc820364fb79e77a3eefd1d917c3d67e0638b34306b448456c9d1a569d407eeb056a936e856a6dd0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb434f49f4b63127c4dce64dea4ec21f

SHA1
9033aa0e4f67771581dc457a0097f2a5a92163b5

SHA256
68ddea4345d67c096681819c1e3797a1152c1572ee6d4936bbd907d6c09b8204

SHA512
0f67dfad9c1d68e342ba715de27f663a87bc567205fcc49372c33376ba2e683ef92a1ca98a8368f113ac05840905d176484871e0be123fd682fec3933b3410b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd9714cc1e50e2bba4bb1f19072039d1

SHA1
fee1092b086663ef18530295b32190b6685d2322

SHA256
f3ad6e5a557dd95a94c5e39c27e13da139cfef1aa938f19039d697c9452efae1

SHA512
ab2ea4c1e8699f3a3a4b3d7bedd397dfb61f9bd72831c0f8feaa65d911744a56427916dca8b553d8f91f620e842dc0d8ff17143d7791e331c77e5d98dff5fb9d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 622850.crdownload

Filesize
1.5MB

MD5
f4e6e8a079741dd3267ac70e5dd92305

SHA1
ca71b5c324df3071660377d53fdde053ae5eb653

SHA256
912ec19ef1a5cbce56029c47e6e450f0ec352b29812356857a790af474a05e8f

SHA512
3503aa802660e96325530cfe3bba07d599f9715fc2f1e089dbe880607955f576edbb7325fc39d832fb633c25bbdf3dd961cc65ba945274862a651daa38b5b149

Download Submit
C:\Users\Admin\Downloads\error408(Fixed).zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit