hxxps://drive[.]google[.]com/file/d/1vDMZjy3Ep5oY9jFvbmFuIYm2LXbIW-oq/view?usp=sharing

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1vDMZjy3Ep5oY9jFvbmFuIYm2LXbIW-oq/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
1	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 402069.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
4812	msedge.exe
4812	msedge.exe
3884	identity_helper.exe
3884	identity_helper.exe
792	msedge.exe
792	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6016	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1416	4812	msedge.exe	83
PID 4812 wrote to memory of 1416	4812	msedge.exe	83
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 4584	4812	msedge.exe	84
PID 4812 wrote to memory of 2232	4812	msedge.exe	85
PID 4812 wrote to memory of 2232	4812	msedge.exe	85
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86
PID 4812 wrote to memory of 2604	4812	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1vDMZjy3Ep5oY9jFvbmFuIYm2LXbIW-oq/view?usp=sharing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb400f46f8,0x7ffb400f4708,0x7ffb400f4718
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\start.bat" "
  2⤵
  PID:1576
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,5320481356252042541,6994592168683770772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\start.bat" "
1⤵
PID:5652
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\start.bat" "
1⤵
PID:5856
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\start.bat" "
1⤵
PID:5956
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\start.bat"
1⤵
PID:5192
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\start.bat" "
1⤵
PID:5444
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5560

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2132
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x4dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
1b89051362e1175f5705b9584be7b993

SHA1
9a372743cef50155a97c0cc1eb41235c4ce4d839

SHA256
067d1077e8839377c8c51eed1beaffb26184c676960639d3baf8b60dbe9cc054

SHA512
e31f0da9aae9ac290bfdbb5a3b44d04a2bfba8f7b284d9d6ab6676e0761dc6a676bc44ddd665fbdc7db418be41e2fe339b249a9851804d9b243f337a9d2d640a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d36d044655f7e595f3aaa4b945bbd5b0

SHA1
063a873ade4d3b783847bbc1d96ae0d7f473d4a4

SHA256
d9c2f685adbecc57093224423964193fc03b882b0774a788e81276cf9e1344b1

SHA512
bdfb2ed40b612f2d76653b6eae32b61037453a1cfc4b7c8ddc598d0e216e14cc3575fee5ce5fcc959e1bea498462316cb3ce19cba8a1084db51d3ca592f2f235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b4e9fde5f566340dcbe6e8d10a441969

SHA1
1a11019bb365aaa933f8249ce2e9e042a5c9f079

SHA256
c4d2b383c8c4a60d719cab6bdd95fdad79779bdd9765e0d5907fe9467104d740

SHA512
53893c04d5b13356a5ec18b67f6d92aaaaf5a4209e6c53c37523f1fe076e701bd73e1aadbf567ab2af71fad9d3e2afd41f4d3f8f4d8ce58c3584796defba7cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
43064d53696bf6fdfc1bb1e233e0d02c

SHA1
291e7cf77578ee4553b1ac92665bb55ef2ca139a

SHA256
932401c55db871a451525e97367d85e09631d86169cb52ce465a8fcf4dedff89

SHA512
e0ac536ddf3aa50369897acfdadae4970be820c306f2020b275e946d7d5ebb7bfab4cd9a0c2aba7af5d57ca3844d3b1997e53b0de2084f1f9ccac04965698d0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33e7e9a172a49e1063d28095804bb5eb

SHA1
75e8bfc0ee7e0c92af5fa2782a7e7367db8a3fb6

SHA256
bcb8ffd6d40ac79a1e440a8b9cd7e2bd98629884ac68b15bf51e1170ae9cb3b1

SHA512
dd82741adb98c35595ddb891e6feb9ec34b7599dac611e0b374e5f6aff05e71d8b15b2e65ec3920c5fcf6af36b30c7145602d0a917eaa49a9de7000e4b5a1735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d3d4229b110fb612e11065caa86ca8c

SHA1
079ce8827e5c6e7bec3dd7e00df9b4430bc9c217

SHA256
13e34924cfaa6fddff5424b3517dad2e392d39277538d030378c954488b0013a

SHA512
514f9a476c61330b4020184ee322e3d3ed0551b5d4adb97838ee6535d1ec8a4999d5c2f96c301bd80288d23ad03cf3553da6a64f70bdf1de1be94128df43762e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b8a7d89d92e05eeb5018f23b07fabf9

SHA1
ee9b0f2d178f0df9a34577730c472fdd8b9fc97c

SHA256
c146ac9b9e6cc0f309121cca851f69a9b7ebdea80d55a2127cccded721bf58c5

SHA512
fabe698ab4755e996c5c7232e2fbe9b86f43770c4ebd1e7c1adf5178d12dc49ca625538d1fcbbee5cfd86d328e94a324eec9da7b9c178dfa961387955f4eea23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a25fa2954a19c607cc16f9910dc33bbb

SHA1
92f94f1ca1668c0179666256c802ac2b257536f5

SHA256
0590045c9267720e56b75e9c613455f55ace1b0743b3dbc6d754d990a1868e9a

SHA512
2d3b621ebf4ff12f1ca5e5d92f80ac028a0fda5b7c972539e3b9138241f024525b1fc6e6bf1fbe05a1c68b882a7bbc0b752980a732d106c1a71a331878dc1507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
305f4a706368768088d4df2e54e53526

SHA1
77dc2ba3b39e05490ec1dc42d9d1ccdd00907047

SHA256
cef57c343fe415b66991ffcccf484ec6f0bfe2e755aeaefb15dfe1797c66f28b

SHA512
5a05b12aab717f3473c5a346c4d808d3710b7c6f164579b0274fbdd6399f9125552f52dde2dde6717869bd58d37666215462c361ac7b4c3d0db6417efc17ace4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dfd9c2e91130b17416d2bbe70e32b807

SHA1
b1cfed2a1c2e70c9b5a0ff5242e9f96be96d0a73

SHA256
1cf564a1492ca3163f54b08e7facf2407fb2ede44e65c1f09da71a0b5bbfad0d

SHA512
0677918da6d308957bc7b752c4bfc0c8f253f9da4a22a261b9a04fcb4f214f45cc690c0917e12de259f8875db3a9f4fe0a07938d9386c382358bac54845c4b72

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 402069.crdownload

Filesize
657B

MD5
aa448d314879d84e7b304fcd9da643a2

SHA1
1c53db02f6d9362d358ba17d48fe6df926a9779a

SHA256
c1d2240ac7fab71a4975aeabc6e43405702936f1a2e0ffec68bb3d942b95f13d

SHA512
8698077e0bea3171520cd6c8b60a3096de9b5dd026115f029f586116039f27f034c330bfe7752042c11908e0010086ebca6c9f60c14faabad8d1d42c5607d4eb

Download Submit