ca01218402981a44f46dff83d9092778003348f8c96b886a2b92eb7fe1bb6940

Analysis

max time kernel
1680s
max time network
1684s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
15/04/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

watch.html
Size

484KB
MD5

eccb085bf14fab136a778d304ba0eea8
SHA1

0018a15d21d10a5b922f519ed14b628289a3d0bf
SHA256

ca01218402981a44f46dff83d9092778003348f8c96b886a2b92eb7fe1bb6940
SHA512

8ae5fbd1bbd6e1b86462b938aa6fce085ff0ff7535e1b6302333cac3c2e1105824eeee6636842088014fb91cf40b5de5345f7dbd6aaa6f7a0e61e2039b7c03b5
SSDEEP

6144:QHMab1abbabuabbabiabQab+abNabTabh8vck:QsaJaXa6aHa+aEaCaJa3aV8ck

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
1404	msedge.exe
1404	msedge.exe
660	identity_helper.exe
660	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3160	1404	msedge.exe	79
PID 1404 wrote to memory of 3160	1404	msedge.exe	79
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 4668	1404	msedge.exe	80
PID 1404 wrote to memory of 3180	1404	msedge.exe	81
PID 1404 wrote to memory of 3180	1404	msedge.exe	81
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82
PID 1404 wrote to memory of 4544	1404	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff85d293cb8,0x7ff85d293cc8,0x7ff85d293cd8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,930767765391868420,7392503327491487884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e15af8f29dec1e606c7774ef749eaf2

SHA1
15fbec608e4aa6ddd0e7fd8ea64c2e8197345e97

SHA256
de9124e3fddde204df6a6df22b8b87a51823ba227d3e304a6a6aced9da00c74c

SHA512
1c9c9acd158273749e666271a5cdb2a6aebf6e2b43b835ebcc49d5b48490cbbf4deddef08c232417cee33d4809dec9ddac2478765c1f3d7ed8ea7441f5fd1d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e5a2dac1f49835cf442fde4b7f74b88

SHA1
7b2cf4e2820f304adf533d43e6d75b3008941f72

SHA256
30bd1e1bafb4502c91c1fb568372c0fb046d32a4b732e6b88ce59ea23663e4ce

SHA512
933ac835894ce6cb8aac0261153823c96b6abec955173653dd56e534d644efd03aec71acb4f8cb0b9af871962296ec06cd03e570a0ac53098b8cd55657543786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5b31ed3a902afaaea98a3813e234b532

SHA1
7259ddd4b58bb5bc86c9dbb834ed7fd8890fe06b

SHA256
036f7f78009ce48555d8f3e61051c7d75806a4d8cd37b6ecd54f05b8d00645c4

SHA512
63a1c181cd76f2ccce41dcdffbd02539e11b86cc10dd375b214148a391fa538a8769b4af07fc8dcc33de2c379b3b7ba7c62801ceed177c103f81e62650368130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3660fe6ccf908bc73a051bc469dc71e

SHA1
f8b551804325435594ddee841481de6d396dc660

SHA256
997bcb06369eb60201badfef90f03aac9e5eea99a7db030e6d836d68096d660a

SHA512
19cfbb95cc8a6c431d61e037e1d92d69452320b6285c486af44a5839610d338ad702d3e65460ba0f5ae4a11b7d1d7aa7961ddefb903cd7c7166b7acdf3ef1aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90682422b6d7fae68463e294202f81e3

SHA1
77ce2f0eb47182660112d1cd9518f42d6ffd94ec

SHA256
a47ad927a96638eef791a5d164e9e04bb4d9b1519c1e85c0c38a1a69d90f0c91

SHA512
1dd91d66130318e13861ac7a3954eb9eb4a8dcce7b4f9a158ea0ce8cd36ec9d953eae83f8ce5decc4b4f703c5bd2ce2b8b20cfb01e7719f80659e848dddc7d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c4df5f69816fab32b95e3956394db09

SHA1
29b6e1015f8397d3122179dadc373c018a43dce8

SHA256
927b4283f84a1c9940dbe4aa00e25eccc1f3846175ae5b5f763e4829804428cf

SHA512
f6c779755864647f78f90eccc30fcfa398468947f37b3df0da1ee321fad6698f7f6b74ae678f90846d91b9a886d9bded14849de7ae0c1f515fa17d3be596487b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\f4ad1008-2fda-4659-8a85-489f28fc560a\index-dir\the-real-index

Filesize
1KB

MD5
28926b554ae7e32a04cd3608b8305df5

SHA1
6507c4565e5eb93fbcf2eb9188fa2ccbcf850719

SHA256
a56f51be2021ddc5aec53a3b3cf578f2d2119b93ca60ecf9632fad32279ff0ea

SHA512
c4803482c6bd92694d302d9ea352e1ccea1a8c62b196f61af6909c96046396ae0d914dccf1d62bb870a5156a747b8202b2221e780c13c069389ce2e734f97322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\f4ad1008-2fda-4659-8a85-489f28fc560a\index-dir\the-real-index~RFe580097.TMP

Filesize
48B

MD5
c49ccede52d7df566ce5f12c2894e218

SHA1
bc4001d64528f188f264fea2d39dbf766d34fe49

SHA256
6b60c7b35646b6250d7cea95f63fc4bdbae3e3a91611e2752860c52547ed41e9

SHA512
4806dbb42305adf6c9a4c53bfd695a98259f8d2484d00cd251c8bb04ae3f294a60ec31684c4e1ffb7c0c46e811e65854709d33f9b3f355a15e7444325e2306b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
73B

MD5
3c170b6f9b1645f6a87807ee5358f542

SHA1
db3e4a0945b36195d07a955642ec1dabcefec744

SHA256
a5ee286f07c72b93787eb941e8d2341d1f2498eb0f7a5d7392e5e698105b73c7

SHA512
8b78f9c9913dbe9f3bf92a7dbb5fada8b4afa260fbaaa2cd79cab80d130232901649fd66a98f04846e6232aa30c8091e1d42ae27f36c1d72635fc8abf6f21adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
130B

MD5
f9a7b5bf097a25da269765df6fd683b9

SHA1
f2c5588dea009da579e98ad1a77c9cff264ac7dc

SHA256
2517b7e7c942a6041135fa487e56d653be361283252cab7e78cf02ef840e02c4

SHA512
21ffcd09ac5361aa2fe935ee93aaa4e60e3ff2f76e81539ff6a6fc2f960ac3b3c53b55604c084e874b677e318ad7807c6cc02b5d80b8b2af5bd9c425bb3b44eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
68B

MD5
dd9c30ec9016ef8eb7b0d0c263f321c2

SHA1
5e0cd62c51a702fce91dda2a9199a1230ef95950

SHA256
dc8dcf4e3a5902b121ab2168df48127bf2c1e02f086a26909ef4838c3d2b10a5

SHA512
429d9f07ffa442ec7a950aed24761e021a5e2703b104fabfedc936ec7f16fabbb7bab059e3c347c3b1e84b693f93fe0863657c090751eb2c6c9f260a9f7d3aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
66B

MD5
3ca5a96ef80b0eedcd1e3fe947c5dff5

SHA1
4939480f38019de654c9910d1258296273780f92

SHA256
9968363f01db9cfab1fae323844ad42c6d21bc417df3842e7f0c48ff26cbc423

SHA512
6193627b797c953afe1173072060d29dbc1ea5547b66c631b717ee3faee2dc59c6df3c19a2f5288cb0a86db7c5cd18ade3b6b59bec4738dcb1dca5aec0dc257c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c5ff1472088d17749be7641799948be7

SHA1
1fe3cd2e01a10e4ca46a578d94704b66d683163f

SHA256
17ede999fc8e18c7db84909b19c2004729c9edab2fa1132657cfe2692b524edf

SHA512
d46997a1d83266207749e5d16600f28803cb8dce08f1ffde6205ef32fa116954ea24d97deaccb28ecfcbfb0d2f10f8e222b76cef22a91d020317f529d8843f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1aa858342b3b9bbd914af4fa42ba3d2b

SHA1
d37269b04359e44b70a4b3f3d130bc08115e6e4a

SHA256
9a01a90e3b6296f182898fed72eb66cc62aeaf1151c29d20d230908d3c0c1cbe

SHA512
e15d03b9c4f182f7272f5ac20cc681692a1a1f456b750f11b8ff65804b4a546726e67f68a0b710b4b23d72eba9579c00a00cef7af9da0ce708816df179617ba4

Download Submit