hxxps://drive[.]google[.]com/file/d/1y3el8iWc_WPPr6BarMeGHca2F1Eicedm/view?usp=sharing

Analysis

max time kernel
290s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1y3el8iWc_WPPr6BarMeGHca2F1Eicedm/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 964547.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5452	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3672	msedge.exe
3672	msedge.exe
2280	identity_helper.exe
2280	identity_helper.exe
2808	msedge.exe
2808	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4640	3672	msedge.exe	84
PID 3672 wrote to memory of 4640	3672	msedge.exe	84
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 1192	3672	msedge.exe	85
PID 3672 wrote to memory of 3688	3672	msedge.exe	86
PID 3672 wrote to memory of 3688	3672	msedge.exe	86
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87
PID 3672 wrote to memory of 3960	3672	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1y3el8iWc_WPPr6BarMeGHca2F1Eicedm/view?usp=sharing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec7b046f8,0x7ffec7b04708,0x7ffec7b04718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12620435393991765849,18442246262256776431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5644

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\kjhg\key.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d9aadb0-5c4b-4589-99be-0ea66bd701e8.tmp

Filesize
5KB

MD5
baa74245dc89fe48f06d33ad9d72162f

SHA1
5c07083a41a3f45ae7b0b4e305726d19ac64a712

SHA256
3331a81cb986f62c651b743187138007c087ebf65abc85460cb74d69d7b95390

SHA512
9fc460d301d502555c52aadb6677f1d844b951d92f301ed634beea91bdb2bb1b9f2e56d24658dd65939155684a20eaa2eefbc4eb95e93c8e8447027263464719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
89e96fd043034f8364f180055309a0d0

SHA1
cd8bd7dc6651155fd4ff275c89239bc219e63f60

SHA256
890b6fde739212389353daf28be9ed0274fd6ff525866cb976800aac1262e770

SHA512
e26113f7c31fee55acb804b03fa5ceff0ab8e70c78beb7e2543dfa052ee71401b20ed5d92e72370ab456a0cbb94757205afe238efa2c08e765b235fe5cc890b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1e26e811428122e32c74f512af701acb

SHA1
38ed7b629f050a4300ab4082fcf0b43bc616a313

SHA256
2cc7770564234464ee316c35b649550226b1aba79dbc4db2ce672863d649496d

SHA512
94b6e44380cd384bc8525f159351ba0397213d57791c4e8875ab8182bf79754a372f94585650f830360bc7616146d6a7356d382c373fdf81fd4a624882911cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cb8a6c8f4660d1676781874d9276effb

SHA1
2207a2a3cb8e4d00bc4c9b81a6cbe8114459d066

SHA256
587de0a9e45bbe9acf5af8d35e8970caca17cb7ef353e831a3e87e034b2e5674

SHA512
5f1c22d388fe3ede1fc16265b30668dfa3910ce2b461aa4e87dd9c3efda3bb30923a7e9a3c3d1bbae8f44f57d36f4e98e344a3e9cdbd1fc0ffd4dc7bf9598fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8f83b16c2d0c5cd36f1346d6f0abf064

SHA1
7543668117ced78cea63217fe9d931e83102f905

SHA256
90e33708bd29fc646c7be5c88bf237546b0a92e12af8a6d7b91d343e691d1408

SHA512
47362bb7d7d44903543d9c42826b37e970a89a5c4e6bb33c2ce599d69b05fb045c28fa6335a6114e664d3317260a56fb01c3e1624fe8fc3f198e0d516030e3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1c7574e789d3e7af737e52c96fce13ea

SHA1
7b8f06685b6f0a8a003866dfe19306d9666254f6

SHA256
b035f673b45a9f03332d90c66b9f60560df7bcaf4e843be10fddb992bff70f31

SHA512
ea38d7a53c9577e2e52797f9193026a6e12a78d2dc23b0f0d90fa7ad179d9d59edf973899919e52670184c898a392885a2d8a7aeefb74190c5ab36db958d5353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
660f30384067c461252ebcb939b93081

SHA1
68125d16b580f7837e7402dfd05dd0790bab2e3f

SHA256
a3d0db92d3f5351d696fc23d2beedf9e253f5693cbafc2738dd9e5555cf9ff6d

SHA512
edefd61afdb667b216f35404f7a0c3dee9362e4ec5379ffd9c26ca8b3e303984ad2d797572114b19c88bfecf1ffbb18fe162057fe645ffa9e4a498e81ba2ff4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d09b98d20dd6ea62ec02fa0119687bc

SHA1
4b4440e58c2d76c18de4e3a649cca329ad07c3c7

SHA256
6b4de254326c8bb0aaa42a436fb484bce1fd1df272680250803bd733201a56dc

SHA512
f94754571877787358fbc3290ae58f21a650bb35379b8baabf098e6a285fec9bd62cc3b59dedf93fa5ad9706a8b12071d4ec2e9b14cfa8030b9e2c519271936e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bacf4d94edc63796751c0d97c3cae0a9

SHA1
a87bc21d19e0062f010bf654247dccc71d3d30ac

SHA256
57a5a38a96616c50814d0017b5275b95d6d5ad7201284cd75fc53a89f3f83f07

SHA512
64302d7f5063b3d3825e66d97610127e79f30e3f65f97d8621f41397122fd765c163e38458fe8c2cff018c4079101bb297d4ee8ab4d0bbe0ef04d5641ec16440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d6a24dca94cb4f7b2cc0dc94d68065c

SHA1
b803a1f1bfe61f19047891d4de299502545c5396

SHA256
db2ef3511f3b0effbfbbffc06e72b6f7876a6dafb3f756581c05f402b14cc482

SHA512
8bbc0dd6b20e79ce407ea00b35e6910cbefe43f091607b39d35c376f2fb753ecbd272bfb8ba170e4c404dd9826a42f502c1d90cf1202702cd5b69f5ad2c8719c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
57d7a18e333fd69e4f3362e429d90c37

SHA1
8cdc56d974fd91dccc3460dc177b83edbb5262b4

SHA256
076906bd13dc0c70d4f21cbcb9bd65232ad2cd4e3c844109c7c3f58ad237cc20

SHA512
101e6c187ddbb9b9d9854e3a23cc08e952926cfa2e3a6cedcbdbc0874ca99a8e24f267c33b9343ae993c3f7ad1ccc1beda45ad749cdd04db2677b862ef15744d

Download Submit