hxxps://click[.]e[.]principal[.]com/?qs=7ee4f8f91617fcc725631fafe0510fc26dc666fae076ab92cd2298d3cebb9d932151e599ab9563f850eaa5dc201cb14cea2cf314557e34fcf72944afafd76f18

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://click.e.principal.com/?qs=7ee4f8f91617fcc725631fafe0510fc26dc666fae076ab92cd2298d3cebb9d932151e599ab9563f850eaa5dc201cb14cea2cf314557e34fcf72944afafd76f18

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
68	api.ipify.org
75	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4464	msedge.exe
4464	msedge.exe
2916	identity_helper.exe
2916	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2372	4464	msedge.exe	82
PID 4464 wrote to memory of 2372	4464	msedge.exe	82
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 2640	4464	msedge.exe	83
PID 4464 wrote to memory of 4408	4464	msedge.exe	84
PID 4464 wrote to memory of 4408	4464	msedge.exe	84
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85
PID 4464 wrote to memory of 3568	4464	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.e.principal.com/?qs=7ee4f8f91617fcc725631fafe0510fc26dc666fae076ab92cd2298d3cebb9d932151e599ab9563f850eaa5dc201cb14cea2cf314557e34fcf72944afafd76f18
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa087846f8,0x7ffa08784708,0x7ffa08784718
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3658768581856647293,310111389592275175,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
0a5b89040fc51d2fc562bc6fe65f6ba7

SHA1
a1734ed4768c4012da12a7c0574ffe6c185ecbaa

SHA256
43d426c3b0a7f0574f0f2b2c6c9c80c47ff8ce0abdb5440967c40d8a1feaf413

SHA512
90933de82669537a357e3e413f8b24fb401200b7f029d056cda01d6bd3bc84521d6aad91db0ca237bc2586361d3f1a12b045b285c335be8743be02e6aba1c38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5acdfe75-3f5d-4742-9374-0c7ec6aeb917.tmp

Filesize
1KB

MD5
5bd2aa26fbb7b830e5c15ccb44f799cc

SHA1
4f3e3e17696b156e0732198cf7946ddcc9d82969

SHA256
8fd4e939ebe945424f7526f0c95a1b9ee6aa1081d912b9e8eea0eb075f79d034

SHA512
38b567a24d6c489a53f62ddc33536c68c2c07d9d7482a9fb6d1b8cfa388c07350079d7b09caf4b86449dbc98ca6d5ea438c79178a366432f6b54d5a14617f0db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c6c6f0e726098a7f61a41d32f51f9ad9

SHA1
cccb24ae3adc89b11fe3e79eb6813461ba8ba0ca

SHA256
266cdd3b5d3667593d0a1721fe51677fdc030ee4369faaa87494d81bad414b3c

SHA512
aa453ad98ba50c994c86465f7c5f82235e6586d3bcb4f26f0e9c1e146a8601d16d5a9e40be22de11e591544ccc3fd508f36db2738958968856cf04999d79ef70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
44bc1f379dabcf6f891a73ce95417318

SHA1
37dd9b9254fe3f60882920b8897efd2d4e15b8ee

SHA256
66f5e4821888d49794a60745cf5061f7f3082979ddd58d6552e6edb0d4d83175

SHA512
1e49eecd14548065cc8fb4d48b4e3b8f311806742b8bce21326babe20dfc1c403dcf6f68cbbf64b8ebb15c79e7957c139b076adc90dc7e2dcd3b368ab87f0e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b0230520ce7c9353f5fb745c36c09ad

SHA1
01280401bc0db41876df6907dc432791a61eb7bd

SHA256
5f4425c7022b041278410ed7e7d06ddb37a20889ab3f7901a537b85b584a7d9c

SHA512
cf2fdfa36032ae45a315b626ccf2c68be3c2c70e0233ed5868946f36f82d727167073e2ea5bd64f1286c0e139667ad70352c683021364c6273336ff12e486715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3cfb3881080507dff1cc3de7438e956d

SHA1
ece93fc243075557643baea36718804fc04aecc6

SHA256
bb4e1068f86b127cc2c41aa12bddd763ee619442d345c527ea00f5fa36e4fb12

SHA512
ea20b6ee312d7a291b88ffadb95b0a3964a8308a63595b1e427cac7ad568f0d0898252765816c6137f18dd60123341436015ce0617719e1dcd39ba1126ca937a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\61900bc9a474b1c864bea53a9a1350fef72e3772\index.txt

Filesize
101B

MD5
8624bf7517f02921ff480d724efaf900

SHA1
579ea89209803e452734c9c4eee371432b126d23

SHA256
194641d106041ed3f050dadc20228d9d1c5d2f30116ccee14f7291053ba06507

SHA512
53c5cf1a8ae1dae6ad171323a94e9a57e78c180089a0a765162328917751c0f7d89d4bc4c1b6082c0afe3be1f5d7326e4fa3094da12b8b09ad024d31bd453a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\61900bc9a474b1c864bea53a9a1350fef72e3772\index.txt

Filesize
160B

MD5
9867a7ded3bc1b7b6bbfb1395d2f2935

SHA1
19b8f4907083d1866bc3bc3a442575b2c386bd1e

SHA256
10d80b00f1c89ef9166ff0503195b1a42370a711bb7a67243848750a93bf41ea

SHA512
af1d2c16ca7f178cd5d3a4b00f4a7ce368ddfe88adf27d9ef0b61a4c623cc0124d986e632ab1cb7d06b494a07d598d46c330f9a319963f7419d796a1624179de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\61900bc9a474b1c864bea53a9a1350fef72e3772\index.txt

Filesize
153B

MD5
a188cef7f3949ca56fc8acbb5375feb1

SHA1
d682b3c8458d2a5a9a020364c1bffb0dbc74d1f6

SHA256
17a6db9cafa547a684613b0f14b3006ac458e4cb39e7c07f29e2fef0981b9244

SHA512
f65fb7f1d0f331797e2e85914a72d7a935b4cc82c72fd57352709e761465160a24d5010a3c67b6c4d31bded6020f3b832d3ba01dc3e738b0f102516a7caa9221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a95f.TMP

Filesize
1KB

MD5
d3f2c8c49888d81f428e97fdbe681e3f

SHA1
05c2fee69c9ddb099ce46b29eda82721abd6ac57

SHA256
56763c36c58858682bd5d320a846fbfe39956b49bce3e178aad4cc1da1b66cd3

SHA512
1f397573537e06a6a2926cfd1d78b62c586769d99405216b2e8b84185b9f373b0140b97cf4637bc4891136cde5bdc5efc3f60be2b699d52e56e4f05a80b12dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f1e5243a1bf79a42139cd2bb573569e

SHA1
2dbfbcf94ceecb9dce8ee7e5d770604012d08fc0

SHA256
7ff00f9ebf865e5c40f1e98aa46f0adaf58ed31ec15210f881077a4edd16e3ba

SHA512
2b2a6382fec1d5372d507a913538addf1145d5ca11271a45463edf924641e70c73f7758b7a7e9b25b938bec095e64a4cea9420dfa1212e4736089775b7744615

Download Submit