hxxps://gofile[.]io/d/o6qAzv

Resubmissions

13-01-2025 23:26

250113-3esxeasqcn 10

13-01-2025 23:24

250113-3d3p8asqbn 8

Analysis

max time kernel
50s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2025 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/o6qAzv

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4640	Lоаdеr.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lоаdеr.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3264	4640	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lоаdеr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 366069.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lоаdеr.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
4748	msedge.exe
4748	msedge.exe
708	msedge.exe
708	msedge.exe
3404	identity_helper.exe
3404	identity_helper.exe
3804	msedge.exe
3804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1252	4748	msedge.exe	77
PID 4748 wrote to memory of 1252	4748	msedge.exe	77
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 4180	4748	msedge.exe	78
PID 4748 wrote to memory of 3716	4748	msedge.exe	79
PID 4748 wrote to memory of 3716	4748	msedge.exe	79
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80
PID 4748 wrote to memory of 1204	4748	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/o6qAzv
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe98123cb8,0x7ffe98123cc8,0x7ffe98123cd8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,11870352745557732883,2301548852485258186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Users\Admin\Downloads\Lоаdеr.exe
  "C:\Users\Admin\Downloads\Lоаdеr.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 1360
    3⤵
    - Program crash
    PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4640 -ip 4640
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6e29b98b236b9b618b2cb3a95e254df0

SHA1
c9b946349064d2f600969498b7b624b003e20e52

SHA256
710e004e5a1fafe03f2cc2f80a681c902baa48362742680757d7b041a806696e

SHA512
f731dd0693d0292d68bf086dce92b0868bf4a4212c5f5f3f532f2236cda84a809339851547f9a49ff03e7821adb5d0d2803d0d24177bcb105c9acf4bae6eba93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
71ab1d71abfcd4ef65d22d3c3aa4083b

SHA1
e47b0a332cbbbead100a84502abed15f269658eb

SHA256
a28e8c7781fb7b5ff64a709dc4235f4abf1ea49922ce70361c936eadd4d0cd68

SHA512
59cc1f3b2f853bd40db8f6addd245411c06178a4dc67477baee12eb0c38812ac77a34f502c30fb6e47ae95f010587395a05d096b00a38cc1eb3455d9b1337698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48d103ce20d2840d9caca0818f09b1fc

SHA1
58a2161286cb01c403fea2dce54622035028f4c4

SHA256
fd4e73a85d5bbf2386818054c74693a145e269d948039137ec3180b3079b7e1c

SHA512
b539242978587dfc58b7bc127f890d1e450c464df479a98087f66b59b43b7e85762c91655102e77a8fe00ceb616b5d03f9c3479f8ca417814291d9b4c656c3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57bbf8705c982bdfc76aaa59f245c661

SHA1
c2c7b58779fae4649a7f0d28a09bedf589a5eb0e

SHA256
72911f3712fa92ba99ca72c8bc78bdc8bef67e296978c4a23c8171129f662916

SHA512
ea6a1a5fb83318e3689c60774e8ab310d8cb94753e85e013503c7942a0f01ff3a1af6b3eafb22ee98cd585f3876f051610a2997bc43e87b37ca1e69a3488543e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce9056d37adeea57219a0d11dbfb444a

SHA1
81fc95f7fdaf2c7dbaebba6d781f05690958a3b2

SHA256
8aa40dd66f7739315afeb3673eaeb215ec676954e8df59207c080a6e50ecde15

SHA512
cf70935e379e1ec263ffc27c05dfdb78d479f2bcbf70a7f2130b3d64d1e1d4043bd92d3cf86f30ab57fb78c5631e67e57d548399809e9b3f74d85470301d5919

Download Submit
C:\Users\Admin\Downloads\Lоаdеr.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 366069.crdownload

Filesize
390KB

MD5
9308e5d6497e88a58c627c0cf6443203

SHA1
57d7900725fe4d06dcd53eb937053349233f06e0

SHA256
d02a9086b3c2f36aaf611c778b60e31705e1d9795d9d8657b6cc78c632dcd7a4

SHA512
69ed6a0cd0f5e49608c2390d8906a9d5df3308eae71b9a46c763f4e1cde4230f8e12c15d0e307172466e974f5b977cb4b7b5bd26b0a46e2e1813f203afecab27

Download Submit
memory/4640-105-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download