hxxps://drive[.]google[.]com/uc?id=1coW44ZxJX3xdwl_ow2-NsTSqqnNlbTNU&export=download&authuser=0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1coW44ZxJX3xdwl_ow2-NsTSqqnNlbTNU&export=download&authuser=0

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3764	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
2108	msedge.exe
2108	msedge.exe
3972	identity_helper.exe
3972	identity_helper.exe
4232	msedge.exe
4232	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe
2568	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3156	2108	msedge.exe	82
PID 2108 wrote to memory of 3156	2108	msedge.exe	82
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 4244	2108	msedge.exe	83
PID 2108 wrote to memory of 5068	2108	msedge.exe	84
PID 2108 wrote to memory of 5068	2108	msedge.exe	84
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85
PID 2108 wrote to memory of 3468	2108	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/uc?id=1coW44ZxJX3xdwl_ow2-NsTSqqnNlbTNU&export=download&authuser=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9264246f8,0x7ff926424708,0x7ff926424718
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,12051772116829203197,7789896676442448118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DOCUMENTO_AUDITORIA_DE_PROCESO_DE_EMBARGO_RADICADO_20250121_001_002_ad55434532446524424ff23654234126545ca15623452315562456ff53442563541525423651552354325_pdf.rar
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
989B

MD5
2c5684740b6ca2b74b141edf92e7a663

SHA1
9c5db784106278c54ea9398400de2f218a8b0f1e

SHA256
ef4cf47d113eb58bc6b4c60b96d0152925acc1f6de7a89b8f9c0491fd0c9831b

SHA512
372496b4f91686f80d4de2de17d4aced93afa3009ecc07af4716eabf02c04525638459e92fe1c1678938c8c3084107d43865673b09c567a1ae6dd85f1a50703a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c87476ad4eeed2f03afa8feefca52ae7

SHA1
783b719a4353b83bf148314d46db3fcae7f62614

SHA256
5132c4220ab9f3b88d0759aaabd798f1b7236709d24a55fab0ea99e669c69647

SHA512
f3ca2b1b7a43b0846f2844b7543176845fd6f54a617a8c053ecda0e16b7f3808fb23dc5bebb89ce264c406654437d35f3baadd765df6398d54f979bae57c18a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e44d35a16ea8d263f2808f522e64abd

SHA1
1a72a0dcaa6064194950ca24f310c7b27e1ca7e7

SHA256
c16d1eff669436ba54359cd945e093fe18c9fe5bf9f5748fd1aff1ccb0454340

SHA512
08048fce81b0a40d9ab98d248ab48e047a0abaa8ca5253a2d53576fb85500e29796976fd09311a9c2718706d8b242e2349dcb8852fb51d227a4633612e222e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cc5735d1cbf16293c5d1c334dceb170

SHA1
b563ff0f0ab152d39aba4ac4281d947ad253f0f1

SHA256
e869b3c969451be928ff69a637ad214520d713b15e8db27b89c8ae4ae3cc9dda

SHA512
feb40a08271d3c785bee50715e87e67207255767013ecac959801a7d8c8ec6e8915f67025a4b03e9128e2e7e56d1499f5ebffbddaa6d7741cfe46d852ae11091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a42aef6a8d70574f3b9c5af6b373e20

SHA1
65ef0ac84d63643b1cfb360696721ad2eff8a98d

SHA256
6167ed38172b7fff445f07cf9962b96ae35c0377d531865dc12b0f1861be5748

SHA512
d423e8cec077c3858f731a932aff52a45937efe87ed608a3a6adcf865542bf72e4f159c42eecedce596095a2d0d2525a7e09b261f07f971470102f5a26ab4bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
abe946815a2d8d0a12d725b5c9ccc4cb

SHA1
c42e85cf5948bf739b75548015b6783af952237a

SHA256
98107ea1479087535407aa712e89dfd4f9ffbeceb916130e61f88b0bf15f41c7

SHA512
14c74f0a9392adfe4ed0eee262a7e5c9d826ed71f4486abd37ec97e2c784ec7eb182dbd2d643ed6000438c27719b651b5f70a2af69823fcca4a321cef96fcb24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
acf58ac098e2f557e84f42c1c22bfacb

SHA1
65d868144b5bb0d469f160ff221a91ea7fc4cc2a

SHA256
62524b9334350ce736d1f79dfe546e7931063c78e0304310882f3bc4b767e4e8

SHA512
2277ea244c135d11a08946f4fe0463d12e4668892556202ad07754d58ff3c2c968add27008e32ec73713f8605b3a311e7da02aca03ca3cf6ae8a258b93a21e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c86a5043-d65a-49b9-920c-a9e6c34ec0b6.tmp

Filesize
10KB

MD5
3f21f697f1661da6744cf69c91877e70

SHA1
fb527e8f1c438173f0c3278a7443e8b1c9c2e986

SHA256
ea5b381a288650d342f1ad9a81369157ff1434053b04ad4667283ad672adde68

SHA512
b33e4ba6c1d9e7ca3ac8bc9714152415210d71a1e6f8c09b7686c85a5c5ddef04125409c987fa775b22787d8c978e98e3983096f94d046bdfc39ecbb92639e60

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 7669.crdownload

Filesize
155KB

MD5
530cb97cdf1ff5077e82a216e351e6e1

SHA1
f90637a0514e5002e37174460405e9ec5956bdd4

SHA256
a646e406d3d2f65a9b6e5781357aa749ed3a28b6a7f9ce3b7df8a58853e3dd44

SHA512
baee4bc10a6e354615f9921d5407ee1f90a678f6434f2d7963dd8eaf8b19c6a9de7b0e2feaf5aa05ff7bc8f117ca8e20ce05ad87fa2037d6dcec24aff9c90f9a

Download Submit