hxxps://drive[.]google[.]com/file/d/10iR9Z8FGMaUy09XPWcO7s9EH29mXhSNJ/view

Analysis

max time kernel
900s
max time network
439s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-12-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/10iR9Z8FGMaUy09XPWcO7s9EH29mXhSNJ/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
12	drive.google.com
13	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BreezeFixer.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
3464	msedge.exe
3464	msedge.exe
3472	msedge.exe
3472	msedge.exe
2184	identity_helper.exe
2184	identity_helper.exe
4664	msedge.exe
4664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2092	3464	msedge.exe	77
PID 3464 wrote to memory of 2092	3464	msedge.exe	77
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	78
PID 3464 wrote to memory of 1060	3464	msedge.exe	79
PID 3464 wrote to memory of 1060	3464	msedge.exe	79
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80
PID 3464 wrote to memory of 1364	3464	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/10iR9Z8FGMaUy09XPWcO7s9EH29mXhSNJ/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff895623cb8,0x7ff895623cc8,0x7ff895623cd8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16748971291269114729,16907687881759433872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
a5cd9bf669d54e21f097b555748b479e

SHA1
9c18d85924e89d0cbab287900549f7137fd3b4cf

SHA256
f5f064ab618b2bde6fa9608b55b6d88bbf9f7262ad8d5ab46c968839c8fa96b7

SHA512
279b8496cba65c0b1f81d838396d43a894248981341ceac4293bfb7d2df59df2cd911b3c2452513a55df6e7fecd46d33eb58ecdb75f93ec694fc23ec780b20a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d629e31e7524f1c672f9f3535b1d5d22

SHA1
eb50c0b4bf0b58145c4960c3d645ed78d7e3b8c2

SHA256
32d52541514174d9ae1ae40ba5ba04b1c450b9621ea105ad5cc9d2b05acd5e0a

SHA512
a52a143685ba7e46b9328b9d3945f18c244738ec5226e232c352557a7b78e22fff3c891fbfdca83e4f41c13b23e60ac430f9d2c8793b6ae7e907053b829cee0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebbd8ff74df4fb9eb848fb1f5861425c

SHA1
753658bb59dfcacb7016da0a0716bcedd7b12c02

SHA256
708749705fb35b33dac3105d5ddb3a504688ddc4a73b43b069aa284725f928fc

SHA512
7009c53a7f74f120575721b8c3f24faf23f59b191cb7f5795acb95a9218daae55779dad396aae243c422105cc0a3f2620af12f97e7e3a046a6b162a38f414fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68fb1329ea4c92a23327b5679bb114d3

SHA1
080f8880fe8c2740a3032ed3254119a695459390

SHA256
c26af8a57fd569badf474d16a2ec301bb987221fd8ffabc43b58ecdcd1573be4

SHA512
d586d20195b19c23deace42f03d294429c15df62d7be2320d1bbd189a75095cb99729690cc4f244f349e1eefbd15417e857d60f2eeafba59cc16168076c9a992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1988c4f76d0410ff743fd1ec41b3439

SHA1
c01458cd3cec8f74b7f3ef620b771608161eb305

SHA256
cae1daa742a40248bc01db09c4048c23209986a985427dfe1ad293f4e820498f

SHA512
8ccef8209da6b0152191316372d798e01d1bfda19963df498512f563c1d28a31a82a7a683b975965d1d8b384dff854056a3a18c1461c2d905e8cf38fbd60f224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8159932c92475c606cee3b85ba8af294

SHA1
bbb97c70c64dc7d8ae5e375858f4216d58e65a1a

SHA256
b0f1f197b787c94a37adeb90397b429c0bacc5de3afbcbcd307d4864fde2caa8

SHA512
f9f2167acd6c5c8ea582f8d64cb97c311f8ec9cd2ffb19b0534d47296b71969dd5f64f929519d2d89a503aa1f9208077dc0e04b7264790ccd23ef0cc608f73a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11c35ee27cf2bb842ed77ae7976508d1

SHA1
80e0b8647d0ecbd0a6ab59197f4fa096553a7f3c

SHA256
5696fee6a8cf50726716f7c9398a1946c7f4585f1472ce221017745381996260

SHA512
16327c487e22681ea9b8d2b1a53f64c3d305496f54b452da4b64d38b3a16d9706b841b3d702a65dca547b7862835d805b9809c4b14715d95611d00f19a33fd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6ba80acf8ed86a4d952e51e82a5ee6cc

SHA1
db480676f9a174032e50598fca75a6aeba00d978

SHA256
9f9a60088a6b36c5c952f1c5b2907592192a3eb208f7dad537983bfce5fef692

SHA512
54bd1d10cb7ef11886aaa4bf926a700f5dc3888fb634d9126ac61854c5b119fdd846e374ea4f592eedef0c7a4f045f5ecad8230ebbc56988e97ee12405930a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2a0359a079322a8ca6e670ef96efd8c7

SHA1
2ed4cfb39d57c243d855640312e1ee24773be647

SHA256
a4200344562aef9cdf73ca508e3fbb59a1c2eb0723fa1489f11edd4dcc089aaa

SHA512
6ce749addefc12367c16191dce6a4b959955a6fc64d9f0081be6c6380185019045e8b5a0a025e5491ab66279bf94a9b9632b5d8ff8f12a98f7fbf561e7e34e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bb6040923f6a015926cd13c87526b110

SHA1
13d2aa727408add360cd971edbddbc3e6a643b93

SHA256
f51b9a1b82d1c8cca6ba974be692121999b88be36e6b944a87e42ffbe9d1e6ab

SHA512
6e5bcaa33ce4d0963005bc0e8bc224017ca80ec8190caad2cf87b1be5e850f87e58aa5f91e82d0225c9cafa6e168f1d6bcaeb5214d7c27cfd403dab085453958

Download Submit
C:\Users\Admin\Downloads\BreezeFixer.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 823259.crdownload

Filesize
6.1MB

MD5
e22a7e0531de77330d1d9477fa36ce7f

SHA1
3de99ef414766f74c8c694d62d188fbcedd6bdf1

SHA256
d090b84f3bebfe3203705986a85f95bfbfcc3034015306ab6248d33e7c971ea8

SHA512
c3eb3eb34dbadf56b8ddcb92b7eaa2784df0697ee6c4bc1314aa945b17849c13b84b78e61d806171f937eab52b8a81cd5836c8857c3d0e9e633e366633a46430

Download Submit