hxxps://drive[.]google[.]com/drive/folders/1GU0wJLW5BTUuN5f1xBUsx3hHfUDAawHM?usp=sharing

Resubmissions

10-07-2024 20:41

240710-zgssmsyfpk 6

10-07-2024 20:33

240710-zb9tzaydpm 8

10-07-2024 20:30

240710-zal2hs1cmg 6

Analysis

max time kernel
68s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1GU0wJLW5BTUuN5f1xBUsx3hHfUDAawHM?usp=sharing

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
2	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
4164	msedge.exe
4164	msedge.exe
3112	identity_helper.exe
3112	identity_helper.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3668	4164	msedge.exe	83
PID 4164 wrote to memory of 3668	4164	msedge.exe	83
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 116	4164	msedge.exe	84
PID 4164 wrote to memory of 3948	4164	msedge.exe	85
PID 4164 wrote to memory of 3948	4164	msedge.exe	85
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86
PID 4164 wrote to memory of 3316	4164	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1GU0wJLW5BTUuN5f1xBUsx3hHfUDAawHM?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e54146f8,0x7ff8e5414708,0x7ff8e5414718
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142468748474059347,4995463951951118414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4648

C:\Users\Admin\Desktop\net8.0-windows\RC7X.exe
"C:\Users\Admin\Desktop\net8.0-windows\RC7X.exe"
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
28KB

MD5
7f5a5d45ee4ea0bd1ccf5178c63f43c0

SHA1
71cafbec33de805f8c65c04ab40a7fc072420df1

SHA256
e47f30921e1d3fda22de0ed56c9847b80e379396ea95d3fe60e04cf9e4c9773a

SHA512
11dcabf8a16fd008783be04cf72e9ebcdc3b37a9a92c0769daa32fcec0a7ac5f1380d5e7636dca14eee05e5787419d2f5782726c94846c39085b325099c123d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5eaf92753bdb4b65d12d50f4a2904f91

SHA1
365887fc6ea052ea1e1edf5f9be4ffc49608385f

SHA256
820eb648bb0cc05f0c42dfc88214a6ebd5949a85dc69c0eb50b8eaa20590b757

SHA512
c565fc72997dc78364a075cf071a02a610f46a4b44273616d1b7cbb5d7fbe700e7936979aa5f4c4da828fd3fd75df1cf7f8e82ea35c8cd36418d6e116f1fc667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e90dc5af1eb64136bfbc89907393327a

SHA1
11dfc7d1a4838ceb3451c69b78215b3b22211f4a

SHA256
6cf0a887bca66157f3ece89014a420075622d5f330932f9e8ba78115ff6149d6

SHA512
674ce1a57b5d910fb30595ce3c7e78953680b43cda3ed1f96e0bf14f32b6aaf543be4e7017689b7990d0903c3f701b3639b8bf6dbd85748f88dd07203f162d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b44b6af94a1bf0da4b9c26c5d58a039

SHA1
0ba0b63780618422270dbf176491a195fc70c59e

SHA256
1af3a8e519f96538dbf9c6bfd8540a6c281be0f66d2506d7999a957cca83b7e9

SHA512
282a6a5eb26cbcc3faf3fdd770ef06ecaf8d036945e75baaa8c79188553bd3b68415ae896f875deab7a09036cfc305582db680293920c9118af011c42c29a915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab5b2119586d8e91917943105253823f

SHA1
574a9bc4846de4865b9cae8688c8a9d1f0c56246

SHA256
9cba061ee35f72064e143241e2c9bf141042e17affbabb70760c71ad35d96f8c

SHA512
5c83546c5864e53249dca295c5b95396a40db2e7ece384b2edd4e39e3416d49d76972329951e773ca3835601fc5dafdc2d98ee83568cc060862a81515a386b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83c114cea3448205ef5d4742c993517b

SHA1
0b2ff1dc2e9220b52714b11f217d9ec7a133c330

SHA256
498d06d1aeec5ac0dce1ca6266ee614550eb790a5287fca02cdc3f55a8ec9f99

SHA512
37c1ed38916b623a9ead93299e7a39f925f987b1efe3cc348d773cc7552d6b97c8fa141656f2742405b3a1f5c25267251f5e7f6f0dc8769dc8cc98338f13017b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e7e5e924adbc66ba4e861001219a490

SHA1
cac6ed175b59b80baedd5ce7649138a2b5acae43

SHA256
6a71fed012f8ee9d8bbe38fc067b04553a11862818d7178331065884397ef87d

SHA512
c515e31af4f67d16b4a202a103925d42d60f03693267d688ab22ff410456682c0f4f37b8a3385d5ffbe8af4ab5bfca1c6d4f5ddb9d54d9b88caf86b2206fb847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b6a2f6a6a6e0be06841c21fca7010b4

SHA1
a0ba5abecd62e61a58dadfcc9d85e37cf76d2152

SHA256
5b1ba4d50f28a507dd06bc5e634b421af4f6f9c4d2c395540c84fe8df699969b

SHA512
f834974f042e843706b49c50406ec6ef5910dd1e0a4eb75f4657216231e6ea10ab5d3e7f5feb95d204d7682d10fdec110d1dd70ee450c83453f2ca28799cc11c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
354459a9611d19750621a307f3795a96

SHA1
1ce69cc3062fa32b5fae50ad2612b44188c08357

SHA256
ca51c8c756d41f769675b9b90ec94c69d8713a3a53af8520b4d98db12bb9d4ca

SHA512
e4bde77b2ad1d928743287d4a1b517a3aa88eaeef2cb6b2f567c5d12d11d3f407f5ad94a195dcb0887a60f20f365a8a54d7d27aff77143f1dd25d3394e8cd17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff89a306cce3b332d311259b8a924877

SHA1
d22b52c578009e615c512667c04954355194366c

SHA256
4991168e7d72a613540e34c082eca9615444e3890e0ebd860002d3b97e0ce489

SHA512
20e5f4b5e4cea60fcf5c28c975fd17fa3c11506b48b7ed78aa3b608967fc28c1197654f24c877ad6409d610ca49ba4cac6366f5042f6734c62cb4a8290236a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
76d1d4371af9191297349db8a4460935

SHA1
755c9f0f510d1e1c358968355de6e61be29cc91d

SHA256
d964bbde57dae86ff830730900aa5526806c3d4ce47ffe6664450258ca6003ca

SHA512
e3a0e23f60aa14a804b3f1c7ff25c210d0840dc3bad38e0a7123b1c28fa1664467d5bcab24bf60f06f3de92cd4f89e74abe26a1261c6038e1bb3e0302b90de63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd5504c9ab5d671e599e89143a736e4a

SHA1
ae1f5f174d93114ca192db25670fb71cf8620e61

SHA256
4a2849654c489c8948d05ec89c465aab0d514daabcecad5a1582db06d12011b7

SHA512
e9b9ffbc9f6205256c207efd5596eb30368fb9f388abf680479f41f898ec3ed0309af86ec2f6f3ba229e008ca4b5c1c6a3876ab0fe31387011daf501dfd9f9f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03c704ec119ff3934fffe1c2b0bf45f4

SHA1
a09fc89af43ae2156b858c18468c12fda08be1d0

SHA256
57a069585220beddd99fefcdcce489f612f572d3f6ec23c45fe5975e0e3dd003

SHA512
a0b37f2daf27954c6fac1a13aa382cd7053a76902fb8a6172bb1abcc20e26a0db901e4d6ed8cac6db0f2fae28b5a8769fc6bf42f317636e7709a287a428b7bc9

Download Submit
C:\Users\Admin\Downloads\RC7 (just a little fixing-20240710T204210Z-001.zip

Filesize
2.0MB

MD5
10b380d8c138603b7373d6a8eb6fdc39

SHA1
49acb4a3a8a80191aee3efdcd527e1faa29278fa

SHA256
28002bb74f43c8f8005ec2501cfe6145c0770b38bf57ac4332602ebbe54098a6

SHA512
b92ea162edca7a37ae15011920e285f41448c1e27f38cf4a58c0bebb0b4d3758e87460251dc89b786ce4c223b6c5fc66a3cda59a9720a95ae7257b6c4ce2535b

Download Submit