4765d4090a1e6d90d0ba90ebad030a9989e57cb47ac7191d9dcf75302eebb110

Analysis

max time kernel
600s
max time network
496s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

466KB
MD5

ff36e5bd7dac9326d37cfaedb03b1712
SHA1

e64035e72a2779d5e390435756f276d903274dc7
SHA256

4765d4090a1e6d90d0ba90ebad030a9989e57cb47ac7191d9dcf75302eebb110
SHA512

3bc2103aa758d9bade6dd57a10923d1c0512e0b0e3c002d04ff9e55b2fe42e015430cb9985d0f5aa9db3f0f7c1417ce389b5d2ac4a6ef2924964a9f94df81c9f
SSDEEP

6144:2TgD/+D/wD/5D/MD/TD/7D/sD/qD/MD/zWl:20DGDIDhDEDrDDD0DCD0DLWl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
240	msedge.exe
240	msedge.exe
1304	identity_helper.exe
1304	identity_helper.exe
1632	msedge.exe
1632	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 3012	240	msedge.exe	81
PID 240 wrote to memory of 3012	240	msedge.exe	81
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 2476	240	msedge.exe	82
PID 240 wrote to memory of 4800	240	msedge.exe	83
PID 240 wrote to memory of 4800	240	msedge.exe	83
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84
PID 240 wrote to memory of 4688	240	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9aeb73cb8,0x7ff9aeb73cc8,0x7ff9aeb73cd8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,3931578572084067813,6402431197090961853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c48e8b68231fb5b2d7f1188b930bc0e

SHA1
1822aef5da8fdd47626fb91afcf79a2be175a325

SHA256
c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944

SHA512
2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6bf056b4ec9469e44aeb11cb9d952b14

SHA1
a6246d3cf9b5a8e1a0f77ca5e208efc86480b391

SHA256
6930f3e433f30649d2905a7bdb42bd045294eedcf4e2811264c310f38948af7b

SHA512
324d200be10b6f6b58fe752002e0fc9133ed6238036441175e3deb16376a9ca32f7a0d57446d3c3554bbee6482ac26d38ca5ee040fecf6a58e28363cd721b9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eb54daba4408175803817711994960c2

SHA1
19be473d860efc8b280f93c2d0cefdb17fbbcf79

SHA256
08a9695af2dde84a4c267282aef8b15a5116b2b1d6e1a53abc490a0fe7301470

SHA512
75e22dc19c29ead56e974e12702745055720b5ef1537593e6b719c80a9a358f002f4ba5e032f6c10d1680132e701ea54aad86eadd10dce9cf367eb6d7a193875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f07b8a142452611dbee8a6a248fa6620

SHA1
16f39f6f07da287fdbc0f7719f66573977294799

SHA256
60e6e37772a33f08fe090c158fd3623ea7ebe178e4f03dbfecc9b1111cdc5fe0

SHA512
aa01dc72dcbf52b705b33e74bdf066fea5add9af02d42acc49a6cf49c3bccc45b93cc1e1c67897b00efb9a67c55a3d48f06a5f11d0a1ffc506ae606e0fab985c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e56d5169eca813f4f40c9171dd258bc3

SHA1
7fc87ca742bf01b95451a1794a894eac52c020f1

SHA256
4c247e14135a3dd3bd1352291a837dddd10db52b392b8b6a464707fe20632aaa

SHA512
17d7aac83707331698035ed258f6fdf0ae02cd52953997378594a86a935240068874a0d13a3777a0cca6f6e00d9cf9ffc3d25c537910f6e0e9a7d15a612464d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abac0d2f81a12140c69ffa4849a16fd4

SHA1
954ff7386e952e7b8c28329b94e8b63729cace2f

SHA256
7f3de0d1692e10f9d2e5159cf2cf4455622b13d5f2edaebc7a681c3e22684b5c

SHA512
47127554276672eaf90352aaa65273e713b533c45385c96530398bd1236454e9bd9824d9088fd9206621916e3d6a2edf4bfebb70c76c3aa2a6db8b2591afca1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\8b0f6004-b837-422f-a1c4-9e8b0019f246\index-dir\the-real-index

Filesize
1KB

MD5
1979093ac3a6eb7b2f43460e76775fde

SHA1
c5152dc6e063c236e73d2b84b3616ebc54314b8e

SHA256
b81c2219cd65bd3dcd92c90027ecb978717c4cd114f4ba3f566d93b82c139a4c

SHA512
308be3eb4bf7f7028bd43b6e0618ab897755a13b34c0fb8bfb73acee4fcadb27625b2975b832216beb6b77974817219d10abf7999eab4442cfd41b0e64fe9090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\8b0f6004-b837-422f-a1c4-9e8b0019f246\index-dir\the-real-index~RFe5894c9.TMP

Filesize
48B

MD5
738b715af1d558b54f3ac63dff6620d1

SHA1
b73e801b4481233aa11178cb9e0ac99475944a12

SHA256
deda13b0915c6cdca85f81d0cce518948ea4f5a8aab6e3779933cb386bb9d5bb

SHA512
87151211bd8d08510d0cd2f51909ed89bcb9bbeb228c51984226ccfbc6d2d11807d099e6f427cd05f76e595de6f41692bd5d843b01c94205fc02d325cc4e208d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
73B

MD5
64b6d316438e6e7bd06eaf54f37f9000

SHA1
f72c5564f9c46bd3ea253085e736b837ef04d992

SHA256
157e746541201a46c1002b8d9086f0ac11578ae647cfd59f3ed33e563c9af439

SHA512
2a564b5f15685caa43d791c9c470237e86389901039ba51df39a30c5aa7629e12e86278313cca41638af5af3f7e5b53d67fd5c8050b51cd21a6dd0a6d9bfa150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
130B

MD5
cdb0c7e0b5558b9a0aff5f580e40d9fd

SHA1
cbfcfa3e119cbf710c1b347e763ddcb3d39e024e

SHA256
e1d3708c40dd7e6a6c4380713c117e08e0aa967084fc1d870b570f3640518d8d

SHA512
286c7969a5a2d2f1b96e887c0feedd9547fbfb6f2de3e3f49635cbff1a4e3b6e405104b956035af2ee66072ff4fab69d0c61a28ab28eeced12acc232d129ca7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
66B

MD5
5b5ad08588fafaab6a2babd278314c3f

SHA1
9473073eae5b50a30449c9fb615710ed041292f4

SHA256
dca4f88816fd723efe949a2e9f57e149df62c7de59d9b321fdd8dbab3be5c0e7

SHA512
e706e43afcec56ab7f8813af68bc9c9438d97745b7eace0241d75245f1de82a610f46c0ba92787e1e43fa225beefdce6916502e25c4979a54fe5f8aca5959ad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
68B

MD5
1ee191e8f652df01f642dd7bf67edfe1

SHA1
9c1c4f3198d39642e91d4a8e1bcb9ab0d685dac8

SHA256
06a12a143d6a577e664a25b9259ff8808bf75cc41ab47135b0d6a4cf1f703336

SHA512
fd000df8a33cf622d6268227c16ec8f779d2e1c562698c6a56557389200973d0d78b392e15ce63132affcb29c8b59f4b315e02ae0dff7a194686132269a953d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d50622fa15659dd3ee07ed23c70cc4b

SHA1
e99a67f8ecb35397b9ef8acf32413471ffbcf979

SHA256
c0683bf241b3e55417b3ba84e5a01dc361912c3fb4ec48737f2d00e2fad04872

SHA512
773e0170fa2eb0499acfc1ad295522111260ad21d6cf5e26d637eff7b013524a83d875550b2e5eb62ca49bbd76576633eafdf429a45ecf4f4715d69017fad4f1

Download Submit