9bd8a97cdfc493d113f9f80dee918c4fe519f20c0b3abe98dba5fa109eea3eb2

Analysis

max time kernel
240s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

watch.html
Size

684KB
MD5

9e2ed75c1ec66c15875cd82b316d3892
SHA1

b1fcc09a2c0460a6d3467d03f458382c516a59e9
SHA256

9bd8a97cdfc493d113f9f80dee918c4fe519f20c0b3abe98dba5fa109eea3eb2
SHA512

4129389bab2fc47b8746368813f0866f58766fcfd9b693352c3833d492b67baf94256e91db3a204b50cd2518dccbe68de05ed1c89054065c8f20e3a5a9b616bf
SSDEEP

12288:ACWfWPWQW5WYWIWpWyMecUq3qfaRDS62Uk:AEMecP4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
4440	msedge.exe
4440	msedge.exe
1208	identity_helper.exe
1208	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2132	4440	msedge.exe	76
PID 4440 wrote to memory of 2132	4440	msedge.exe	76
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 5028	4440	msedge.exe	88
PID 4440 wrote to memory of 1436	4440	msedge.exe	87
PID 4440 wrote to memory of 1436	4440	msedge.exe	87
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89
PID 4440 wrote to memory of 4620	4440	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd83346f8,0x7ffbd8334708,0x7ffbd8334718
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9850968283593236915,6058180900925448619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d62cefeb0c8fbab806b3b96c7b215c16

SHA1
dc36684019f7ac8a632f5401cc3bedd482526ed7

SHA256
752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

SHA512
9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ee1c6757da82ca0a9ae699227f619bc

SHA1
72dcf8262c6400dcbb5228afcb36795ae1b8001f

SHA256
62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

SHA512
dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
298af8654b9f462e4fca483d6c7c0ac2

SHA1
9652f7b20c0a08e413e996dc3bcbe5367454976e

SHA256
8a9bfb2526a8796135170a444fbb3ed14071c680c4b1c8ac4dce74e46b3d3d4a

SHA512
e607379d872585492a18d504f794d85c861beabf631e983dd2f1bbd6757b683c657ac119da1322b67879baa6e6ad988677aed54223769c720313ad1eb4621668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cc18db9ac99b95a08bd97ec5b57d1725

SHA1
57f68a521dffda901a3b0ef84dd2d155d016b7b2

SHA256
6ad546cbaee94d2d8132e2fefa8181a2fa89b292dda593aead8dbf565603cdd5

SHA512
f4f627b71d38b446f00abec292c6eb6f215499a3ad7a5a9f7185357aa1740ced18a6dbe54c26ae31de27583b3d459fa76827da19ade9660a804d1a49693709c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cca72d7e1bd0cf9d71627847c5189b96

SHA1
826f66ab095b647a6811c21e44d0697873e9f19f

SHA256
1a2793980134507122f0bbf7341d4e0032e0ee73933bc454da8a6f0baae220ff

SHA512
306fca2a9010347e3204ff7750ccc5af2dc704b3c8947885874aaa1ce06d566b094d48d70918959b05ea6da4cc1a8cdd967f097c6a2ab259d1e9f27d5d08806b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
118fd27809315f99f693cb26da4884de

SHA1
bd186b088b14390bc29deeaae970d5ff65006745

SHA256
6e1e071e51624b104093fe45cd446920c61f9846840806723187b9cff4b61752

SHA512
d1911b5549f670b1d9f4e630df77aca924becfe1cdcb805b8825428be1af9c025d6691f4c788dff9be622055d934a2ffe453a4b11156d38301cbb4e867973b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57196e59852508069b9af4a6f350eed1

SHA1
a6de171529d2856f6fcbdffa3dfe255baea08826

SHA256
26073c89e74c729487f1655790dd7f26327d1c56ab3b33f32ef3433a789a9dac

SHA512
4a3eec7eba2caf3a9a95406cc486657c0c1ac5bf5d375a24fbf8a9cf1c1b367454aab83cb3b782418e8da8697e3292f98c9937d8d2f178f25ce63218ea83966e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
382fc60a23dbf082f913db5747fb4898

SHA1
ad029b45435d013f19a6a7b850413888db7f7f7e

SHA256
cef864219494e6afdf1ce2d2ab8a7a130deee2fdbec432c1738bd386fca93414

SHA512
c37e00310ce318bfd73449bc6229f66f28248f4969a30579e5482604ef62222bd55e8e91417db1d6b21e6b20f0c0526ca8745060818e7712328ca59a7b3bf370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\41c7e88f-d3c0-472b-b3e4-02d5e98f6f4a\index-dir\the-real-index

Filesize
1KB

MD5
c104db36a11cea012697f531bd40ebc7

SHA1
221569c84c8f460aa62a6a32346d126ef19447f7

SHA256
c19746536df9b4a0828c7c2472cd0b4ad0e573894fcc13a607de94c1d7189e44

SHA512
c57d7297d02d847937adf42d6b452fb0956902fe302093128e574727367fee49fa0c5ecabc8fa11dfd36e737f649b7ca93b1ae36bb496029f50c2b4fdcce6821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\41c7e88f-d3c0-472b-b3e4-02d5e98f6f4a\index-dir\the-real-index

Filesize
1KB

MD5
4dab0462db570ebca5b2166cc5127154

SHA1
cb5cd7b24e916b05afff6b910018477d8d8b23ae

SHA256
b89d5a0dfa403325022b0cb6d5104e228a821e81bac2c92a4f6c678dc4f9ae7a

SHA512
14088b0fe93312e676f6542dc5ca7b1b1e8394afec156fb4ea471eac6316d35b4f8061ef9d4642bfb5bf67d6aad3b67584e6049ae9bbf01505c2acfbb638b3a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\41c7e88f-d3c0-472b-b3e4-02d5e98f6f4a\index-dir\the-real-index~RFe57dea8.TMP

Filesize
48B

MD5
e985a878012ee390073423e197292d19

SHA1
673b51a1c7d558c0edcabfc7160419d67176fc4e

SHA256
30e0c24587994d2ba1b6aafc365a8545e44333cda0b65b32f500df0a99b3f70f

SHA512
5fe6ef169c8bc9fbbe2c06b28709534aca299e1fb38107051a8639cb8177c870ad36d504869acc0fa16423d90cd3ce0934780a1084799b74217c649643e9f275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
73B

MD5
2e0d36ccb1c3ff9e57f2a27dabd6c7f3

SHA1
30c414e12322230b76360e9385c4aa6c80db78db

SHA256
b635f5b7aac1140d2441fcde6c8c4cf8f8b68c5e817f5a441b2c10685ba89181

SHA512
4906dc90bcef3e8da266665046f69483609d00056afc6f68a9499e986633f39647e3708083d572f5904497e8cd34bcbe052168bae36c9cdbd7833d8e12d22b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
130B

MD5
55b2517f2671f9a9c956d946adbf4b53

SHA1
5a5bcc5b399de131cd4514a0f75beb77c3f7af63

SHA256
b2ce3497fa7be889ae8375cd36e89c227977185e3719aa9d237387b8915fab87

SHA512
1db1e6ece2aa8f35963560e7edd138590426c8aa01499b6a430cef687cd8d6e405e149f5c985b0830eb5e8adc1f713463eea22803d39b1ff691bc40d8fef173d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
68B

MD5
0bea210676efe0d44d9409c5f2f38821

SHA1
65aaab2808c1d8712fc147ee492df49e7bfd345b

SHA256
af9a9ada95f8bf5106297958b22e008fb263b6e23846f2432bc194a2fda6bb28

SHA512
0134a55fc8a274e8b60999b0f2213fbd41a412eb31251e82aa12883ae8fc535ecc32a941c17f35c106f732232d6cdfcfaf2840b717e6911d9eb76492930b8e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
66B

MD5
8c2987d47673fc662e5d375fd7449548

SHA1
16e837c3885f1d1b1cf144403c0ed6fede8ae685

SHA256
e56303d4f1dda9e3d3f38029a24e7eda032a12fed01a33aff46e0ea4c8da2639

SHA512
428afe5b21e26e37022874efad10a9aa80887cda06f8fd15705dfbf22a912ac68a86e3202a085c5cb423c4440fb09576c61053a046c55d27e626c9416a544504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
68B

MD5
11f89bb3348f43f7c21a6d03eb80dd17

SHA1
4d9621e744bad946dac879ac79082adef8ab7910

SHA256
e16e302f4153faa288a5fc7995125c5631e24f671282e9c9451a38dc747872ad

SHA512
898a72e67425e2d8a83f051341dee5797f7b95eecddf78c25332de30903bf3ac7f50c82c8606a2521525b06330539afb8ee80aaab57de4dc4921c6841d3ba278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e47ab6e37188ff8c80ce0a1bd3fa775e

SHA1
4b133f0132f24294a23acb69cb82254fd31a4262

SHA256
c613cb17cfb8407f108cd13790ea4d2d41b1221881cc2cf2f5062a2191c76357

SHA512
119a36212b6794414153ab0942c8d914a629ef56e3b9eeebacc8f2e3be261742900654da446ba691f5f52e53829a6175fe1bd041b8890421f73a5839b90f8ce1

Download Submit