hxxps://drive[.]google[.]com/file/d/1Zc-c2Swku3lGkOOBaTTzL9jZZ5XiSiI8/view

Analysis

max time kernel
900s
max time network
885s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2025 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Zc-c2Swku3lGkOOBaTTzL9jZZ5XiSiI8/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
3020	msedge.exe
3020	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
5016	identity_helper.exe
5016	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2892	3020	msedge.exe	82
PID 3020 wrote to memory of 2892	3020	msedge.exe	82
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 5056	3020	msedge.exe	83
PID 3020 wrote to memory of 396	3020	msedge.exe	84
PID 3020 wrote to memory of 396	3020	msedge.exe	84
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86
PID 3020 wrote to memory of 2196	3020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1Zc-c2Swku3lGkOOBaTTzL9jZZ5XiSiI8/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc865546f8,0x7ffc86554708,0x7ffc86554718
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2484 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7094817004750822162,1187462300245992309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6a53cceb7a396402c1eccd08dbe38a73

SHA1
96e06029b79791df1b1a0a7cef7508a5c44d13c4

SHA256
31c8ba2ce8a088515e4feff78968e8916c759331b7428421a990cc349a208b51

SHA512
bda381d092d0272a19350a66533ec0fac2efccfd26fc87695a8270eb3d4abec01483b31dfae75ba3f128623454d471c9e948c44df478edbdb6b5a15377637036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a451e41e51facc395053e7b74c3490d0

SHA1
c866ac24af529f0265e99bd88529da46c9ff6dcc

SHA256
cc33bfdf9c856a2e9e9aa8eeddf9723a0396fad82b0dcae7a408bb4c84fdb584

SHA512
553489450d55d7adb9c859e521d0e46961490e54c533c826adc8c546ca0b51ecda82c159801bd060a291e724355c6d4fd2ee603ff65d4a15603f34f1472664fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6fdb92e536fe51608fccc96537ea629c

SHA1
c86ef48718a5b0db52d0901204cf95c17d2f8f89

SHA256
a0270a04e7bda09219c00ef107a04564362eb4828474c2abe430a4e6e234666e

SHA512
7d61bc9e4560f5e150a4301467a8455c9fc7a41c5c792ce8497f057a8a2edcc4006de988c1255b8afa80446822716b036c2d89cf3ce5b2e5b93bfc768a71b6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
8f53ece3a1399ec4c8415cc0296feb8f

SHA1
7143a001e5c7ca47d36234a12448463ad8fa997d

SHA256
147e781fb3df0d5f7a911c9d0c49217f5309cb3368a9292ca1bcc52328387167

SHA512
03dc11f8edf9da061147890f2922995972e69db6e208da62873420e842e70f33e22de5d6e57ac9c77c9e58af51da1e23bfee6efda4b6c23c7a41f972626a2719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0ed6f82287598bcb0f6fd32bba86851d

SHA1
b196977322d5fc00e1d4eb129a2ae8c34764149e

SHA256
5090cd11f9dac8cd73ca1a87b8cf10bc14130703741aa177af3267a024496d02

SHA512
6fff4b07237d9b1c782f71e3b048efee0f19eec0ec75b6f4ba4293d6d7f18c9f91d90e11c778cd6060d82e9900401a40e4323c6b9fee0c4ecfb6d173d82f334e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b81aa5cda431098bc0736a943cd05f7a

SHA1
5146be00068a7d322000f8830dc5c1c4ffd37ace

SHA256
d3248c112408f973770618660d48805c167a18e2c26df7830988ef42f0ef95c4

SHA512
84c527fd881c137071e6becb5d3f64de1c3cc401c8852f189fe0dccb4cb8204d4ed3fd06c2f5b863968cac549a69f563052e4b7384a39bd117bb1f303bf961a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7e89d9e20f8fd97fd7a0484aba40cdf

SHA1
5bb4823c933402877f11372bd91ffad33671623f

SHA256
dd3c782d868b238cec2b84c56ade83ef3db4f53ed3607a34fcf15d9e35184ff6

SHA512
6e29449625a380fc3a5c966263fa20ad37009a155338001991a4f47b8bbeddf85798b6fed5643369248f8339e77786f69821974fe73fc5a451aab24c75202094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
97B

MD5
a0c903a1f5411a71ddceccb562e1d99c

SHA1
1d93e35cb776cccb376594093fa8bb7a802c75d1

SHA256
39154ea730a784310f79bf1e0a4fb843e4fc9edcc19e1a7663fd8c375fef3d85

SHA512
813ca976afdfcf5d57807d770d95a9405cd0c37e79573ea74a2a6a6ae94f565960822e27774b225508b221fa8c9e9ae2b2a42652e93beb1afd54a6521e74621e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
33B

MD5
b0195b619cd45d0f8af48fc59c3d7716

SHA1
d153ae8be73da841309a68f26d26642d05ac20cc

SHA256
37bb3e6cd75d830156a6934fa1d1516121b37b4a220705fe32adece7b7ed927e

SHA512
6d917a97131baa380386bcf2c83dffb97f832e85f9510db3df4f7cdcc35396da58e5e098fbcf3fa7867b7909c09158d091ac0432919ca685ca5c7966b88a23c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
db20919783f7284328b265352eec1f11

SHA1
625cd0b55939da897fb4755ed3c825d6a9553497

SHA256
4da3c06075053a45ca7c0cc4ecfe8da94bb92452609b74abd81f15d8f9e00bac

SHA512
3f55bed40d5d5a8c8c90c961bded029126d4c2e6535bd0193d7f506a5b6af97d6ba420861d2f01875e476163d46636e5ff0d55f65c5587fe8d8bad1483f7bb1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eaec.TMP

Filesize
1KB

MD5
06fd674ef301d8b51fa8e518e9da3287

SHA1
9a75dbe300312eff30f80fdb5d2c73c8031e82e8

SHA256
0fec2d7a571ed141f43949a81ef49cbb8823de25eafa7268a0bf6c3350f79634

SHA512
959e0f75e062cfc920b2c501fe05b8790ce0cdd30b3529aa07d1b8fce6765b9e28f8fa9d85c5b82af0557ad8b420d15865181525c015d298d94c82933516ddc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3a6a43e-5aa1-427a-86c8-46e41cc6f875.tmp

Filesize
6KB

MD5
8546a00d6b012ad5605eae170c351f8c

SHA1
dd9ba89dadf7a56109e683d067054a6eba20523e

SHA256
ac09c21f09838cc777bbff89e53eec622628af32e5b1666ff4e90d962de279aa

SHA512
4e98f5e01c946cb2ecf56927d01326ba168c6413beb119d5803f1b99c39f7b32cad78bfdac150898a46d063013a87beee6668f54eec302b97a359f1f8b52fe09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8cf5b4e02a02bb1c44c62971cc2883c

SHA1
8c776275e73933e6f53b4815ec54372e9fa66c10

SHA256
4f7d842334da6f1f7d0ea5eb684d5b255e9af60c21e150f05affa4c036d46acb

SHA512
7ef48e0be8128ede030486571e41775d22d3824afcfb6c4982bb7ee57ed2ac440c114e62867debf183cc83c9686dcea0a915e6ecc3ed7fa3352ef706e65fe16c

Download Submit