hxxps://support[.]google[.]com/drive/answer/6283888#gid=1616818362

Resubmissions

19/03/2024, 18:15

240319-wwd19abe91 1

19/03/2024, 18:10

240319-wsajnabe2v 1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://support.google.com/drive/answer/6283888#gid=1616818362

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
3664	msedge.exe
3664	msedge.exe
2248	identity_helper.exe
2248	identity_helper.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2152	3664	msedge.exe	86
PID 3664 wrote to memory of 2152	3664	msedge.exe	86
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 640	3664	msedge.exe	91
PID 3664 wrote to memory of 4476	3664	msedge.exe	92
PID 3664 wrote to memory of 4476	3664	msedge.exe	92
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93
PID 3664 wrote to memory of 3612	3664	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.google.com/drive/answer/6283888#gid=1616818362
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4fa346f8,0x7ffb4fa34708,0x7ffb4fa34718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2010382203986943296,4306806971824829628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
27KB

MD5
93e7c16239dbaa1d7ce242fe773a0950

SHA1
69f8f623b98f7271246e5104e5b0be96666be9cc

SHA256
4c08b630669724d71e5946faa29c85e9f62ca9e5aad1cb9625ffe27fb0f14d32

SHA512
bf660c22bcd64eeb197953ef2a43e31bcf73564e2cf854384bdc1b050a9804581b7cbfbaa8fa24afe3f5621cc43ad72c2c88d9d9dfabf302aa8290c5dbf40c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e2a319bbdc9ab073770baaf1dac8c52c

SHA1
97cbe9110f4e5219b524dc44022ee23bd3b6f1b7

SHA256
69583b03aeb465a964891a76a157107808570b9663cabcaf9d5cf06a94c9be6e

SHA512
394790d7532625806774522f23cee514bcb0f8aa3c4f74b7c22951fba84681a298c4455283cfbbe33b6be948cbde867c6c7d1960a6ffd08148cb0e3de1ec6647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
020a03c91c071bfa0635bcabdcb3e207

SHA1
d8396716b21104d6152f951df7f6577a898afd97

SHA256
cccf0c11a6929b2af4b0753691c1f6f796fe389262e1d6e60c5659848a0528ab

SHA512
e0788f19d28092bcd3cc4369fa6fecdaabc66f5d4c42b2d70a013e1565d4ff0abe8342118f7af28a0eff74cd82d8d20c23e1d5d5c1d845efb4e6aff08b5aa088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4002e6b0c33eaf8a5ee7377696891dd1

SHA1
a3342e94a15639998633587ee5b4b4eaa15a63bb

SHA256
fcf5c429efb00ec53de81410c9f3d84d71ea4dfdd4412beac88debc6f287193a

SHA512
e06687e74595123aca4a3471dd2dd71b9ff9b37ca6799bbcd86496a63b8bb9ef8b37b33052dc67c587cf6f06848139e7c04a4c3265b905f72cb1ef85d0af41eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
c299090b88a771f6381875a82c199353

SHA1
8a27579f5453e4248ad113cc48429b3fcb0f907a

SHA256
1ee8fab3709aa0db2774000abcba9aa0029ff24ac242ae73a1b9bf77bdec52f1

SHA512
83cb5f135d57e5bd7c7f94147f3499d51d781865d9df93f7bbd124ea7958f3de14b43fa906ee399ffdfc7144ad1f972317abf1b8d693e43bac7f5a936540bf16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0110bbdde881c2a7398d86882946de83

SHA1
c8364cdd05c336172172e4691cbea43fe96c331d

SHA256
c3d49380f12b46094ccd385bb44fc9fde75a070f80b98188c89f5dcc705045b4

SHA512
69a61f04760a341f3bb9a0e3dec881e006af4f932b3b628ed40edf26510ef6d88659fe216d3f5a2441b14092ac719eac33f78d754d8421f6b50aee7aa4a56f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
576c9de03055471c521aa40141a0304b

SHA1
696a311d96c8f2980be2fc12b632a61a19c69021

SHA256
229300a00686b0b4ae71bdce306182069969b00206965031312eb4783305c942

SHA512
6b541439203cef68707b315b56f24493322bc5701f256fa7a3c27334a951aa3db99f3b68336cfbdb4348fe486cd033a0611be80bc820f88a4b484c0337c749ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c5ab7e2214d3d7a567eda998fb96152

SHA1
e82593d9b32d04b8a3052de314bad2efe57ea24d

SHA256
3219e1636d6188593838cdd69c7733e877cdef895fe229fb8cb1b4b03afcf733

SHA512
0f241fd95a1d02f7dea24359185f03e2cf3e86b9be0f5348626ecb816b5a3203ca299829b65592f1c37f51da834885ae821534e85e16555e44087aaede591890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d519378a6ef49fbabd7cba05a146ecc8

SHA1
e39cadbeec42877e90d9d31a1040534166f2feee

SHA256
7995df34c46f27b60249d6311514801d1edfedf05bbbe8e18d5899a123fa35a2

SHA512
56f2a05928ec329e792c6d809ae1e2c5a189d3c87ac778e3f5accaf1d689f781ef0bd14d43ade7776d9ddbb21fadd93a1b6c4e5dd39e1dec1bae489658709d26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
110445e34eaa198ea2f75c9f3612a35c

SHA1
16c2bff5c2145f2661964e5e6620e3a964278ea5

SHA256
499342cd64b0dd48f1c0cc0574a0c5c38d9f60c45c267d5700bfcbd5036e9185

SHA512
721f70460f79dc10d4e25d2a14f70dce0be190b5340dfefe7c21cd293296a2e8bce1b2a33154074f0a1a0dc81cc91ded0a7ac0b262aa3fc06e35da905c63d256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
78d45e1f99dcd778a95348c13830fc08

SHA1
77a875310cff7eff23fe323f805d4f990b291647

SHA256
628a035bb1716a8a8ab15e69a97e166e7c83a620ae5a3c6574d28b88826e2464

SHA512
85bbd4e568fa0968140845864da8365d7f84220da2cfc27edc6576cc4abac1d839878014925d6e65e471fdc4b6d06c7136f0782d10249cdc5a5940d140ad5100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fd2facf202d88aabdc9559782c831e3

SHA1
39a819185a74e0394f6554e15189af4757e14511

SHA256
5ca53525b9e412942c76fc234dff4da4d0890df67a57296ba17e2f416fda07a0

SHA512
916c6e74f7aa2fe988c7295fc25355cfa82b76719ea3811d02e8551c064da0ec0c6b6caf3034697343f68ab4c2dbc6ee6e2b48be788bdbc1891fa91822512237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
480d46d769932ca5ddc12bba6a94848c

SHA1
fa6f5691b02c62e3dfbbfa7831ab67b0b4abd74c

SHA256
4fb8d95850f2e40159cf8c292eea023d7843abe5d92c412a4ff53b5ccb00d857

SHA512
9cb5a3de80fd8810ebfabe4d85b2ec98ce6e221a97928e85a3228773089dd4f94e5a366ae0ae85a435552abaa3019aa8cd3a8373eb5214863878b09b029e7ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d37b53bb73be135dd23033e43c28546

SHA1
9d1c53a2bebdcaf0ea0e651d7980d32d7c58279b

SHA256
937af2eee1c84b54c52e000a5aa144fc7c61ee2875f59eaa49d4e45e59c0de3f

SHA512
f55ab93c7661cfd6461b40378353c87f087dadfbf7f4f01a8365f12826d1131d08a4a3489bd5d73c4dcf486b828e6b93dd55c5dcc7c2befa208908b200ff6337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6737a63a541068c988fed7d8a1ebe62

SHA1
655db68e8a104125417d77451c95cbc70366e789

SHA256
b0a9547e38a5f022298a7fa782eb77e0878ed0e4997d1619a875c83597492531

SHA512
75d8d962e649e3fcc17b457209668a61da0c2ee3bcc277b74a87144d9ffa5b603e7fa033381c766291638978426f02005737d3e1b7f11efc3a67a9c4e5f09e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e8d5c3578f4d3307ed3e30ae2726b452

SHA1
13f9c97909fe58ef0c81841bf85c6816cdae490f

SHA256
1e6157a541af066374ac9bbc4e49446946aa5b8fbc2b875693e213e963910970

SHA512
6dd851a512d72a2ff619a9b367c2cd3b2d45a0db532dc7f82ec1c8734302403c49902769f40f66882036ba65f8cdd92d474eb4cb28815a6b6ce96f50ea95144a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
853e14f0aba79cdef3c781efb9ee8b9d

SHA1
2c80af3b29b777cc7af9330a9281db99cd9c353d

SHA256
f8051f82dafd1c031a4647a3c6bff7a4a1a3e9dc2d9fd7ce170b03d6b61daee5

SHA512
65c85196cd3b92fb0953c6eb926afe456e06625afe33faae87ac6284fa2a6336fc24db8ed51d5a2a8a93aa332e38b5588aa1ff1de6e35392ed3eb70d2af4af68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
03a1ead229dc4ce9e89c03e49885ff0b

SHA1
044dede288975e778beaf594e16b84aeb3234299

SHA256
e616d87806268ef9a3a2e27eeff3102f97c8070f2c13b268d69fe8bd4824c13b

SHA512
3d7b0f4e143e11b748b2accba4711e3569d11f517f091836d3892ba54b0c4a2601717ea5035dc045c6b0a815c36794fa48fef41d25290b7ed720105a3f366799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c7bf3c2be4d264dbae2bb1ababff15e0

SHA1
a37f60e59efe7f939a2568cefb4d4058c2667574

SHA256
a39bc434ef575d429e1663ae8015d060d05affd571c79ff75a31c9626d826d89

SHA512
27bf2dbad60724d4f38ef3b0f120b6369b81bfc0c7aaf4cb9f1a5525dfc9bbf5be9840d56255882a8f1f39c278b197f4ce547f325c2d08985441123993eb200c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dc95.TMP

Filesize
1KB

MD5
bf1065663fdfda4e85ca07e24de781fc

SHA1
c80f5147273539dfa6fea3932c3acbc299d51591

SHA256
7cb86f7fb9e089875961adeedb1759c3ed684060ad49e3ca1cdb5ecde4fdefd0

SHA512
fa8e2f5ffa2491cf07d4dacb3459a4b7000c15d43e1d93ecfeddf70c30250ab93c31298e20b792e67fe1290be6fd51006ef3d3c7286eba9c6e7e4be85afe0de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
76080d9c244b3a2f9c8af2bcec008435

SHA1
7953ceec25e01196cc9005e8a3aa8a96c3927c87

SHA256
41ada3ffb0492b2c21ac77d4ff422bdc54a0438cfbde0b361276752561caf1b1

SHA512
e5f7eede8bbc7942f78469c0eeb25f4ca3bb3c8550d3841f1d4bc0b6a97f1e9f67f2c1eaf001ed71e28dffe26bef21f32664e3b22c3953fe7dd62a746311f5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6173cfa585a59c2d743ad86fde8f3c6c

SHA1
38c7ffd9e8ad772ceb2651b16f90774474b496f7

SHA256
f6c2e0bbba8bc7f3e3d3b0125207b1bc2dc5c03a7a727ddbd3c0aeaa7d6f99f0

SHA512
ae6f8e053748b0ba470366fa2added64d1567710a7421cf9492bb343457660a93a52bc326314fcc680a1d116ad286ea03ec6108d81bd5ca5bf24fdad05980409

Download Submit