hxxp://youtube[.]com

max time kernel
1752s
max time network
1691s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4472	msedge.exe
4472	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3032	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3032	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4244	4472	msedge.exe	83
PID 4472 wrote to memory of 4244	4472	msedge.exe	83
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 2036	4472	msedge.exe	85
PID 4472 wrote to memory of 4724	4472	msedge.exe	86
PID 4472 wrote to memory of 4724	4472	msedge.exe	86
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87
PID 4472 wrote to memory of 4308	4472	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2bc46f8,0x7ffdc2bc4708,0x7ffdc2bc4718
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9438276529113286789,8844178029493691981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
a207a3d5719781d7d31867d09de4110e

SHA1
f743e15ceac58819031585f3a3b672ddfc5180b1

SHA256
c311db3a52fd04bb1cffb513731446f09b8f6c2a530133174b802662e32d40e7

SHA512
0a55dbe9af4125985cb4e140c7799d44063e35635e155cb0d44ae23522bfd5cb423c2606ceca43d9435a478e29cb9e6f544390b463bef2ffd00849f8f4ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2f4a6ca76334c99b8c2dd5e67105423e

SHA1
ed089df100f587a8fa47f68324c9cb590a4667b7

SHA256
0d1e035bd3d78372907da93f4045312605c86a319661f4995e838986f8b4f98c

SHA512
03450d225dd3d007b155dba5d281360ffabbe0013602bf6c339b6e120aaa71e08875e2eede1b3dbc52649f58ca3073d8d10b5303c7495e015d5970c7cc7efda5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f1b24b8b5e7cfd7b00b67311363ae24a

SHA1
3cb22cd89498a30927da42dc97882f495b76e553

SHA256
6e0e26ec3c80fb7205c6a8b24405becdc2dc9f9bfb1e44c075ad8568a859add1

SHA512
0f560ae964b69006e4a048b4ed601ad3a53aa2287dd8a44a68bc5496a3dd9d298729de5fe7bbe238fd1f2f696f83b6ae6234bb8523fdacfe2726e49c9adb021c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
85917cbf7d5c54a38717af61fae706b2

SHA1
27f322316ffa28b80b042cec14fbe74bd16dc2df

SHA256
a98a02220719ef1d550998c00737bc41cf833f2eba77721df758c72fe77aa2cd

SHA512
1e148f8f0f6c175bfa3faa8652795fed2a9a57b3018f3e979bd172f494745b41a8f56af236ea3f57430da02487abe027d918733607ca36b4e3ada33092e07c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fec659e7efd826a4ca188162da696880

SHA1
47545f8d223c7320858c72822d5917b62e45de40

SHA256
2e490a6c8ca4cd3bfabf1293b61b0caf1278279236fca27116fbc8f84059bfc6

SHA512
f1a3c953891a5a01a403ed0c58ab15150c6171b1d2ac79bfeee4d7d74cfc85035d11a2404e7f0e84c1dd9d5f1344caaafaedc2de3d9164f0695f1a42b12ca6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
614cb47f180087f868936448a345c44f

SHA1
b0af1de804e39e335706986583a63159c72bec5c

SHA256
eea2749caa9651c1dac20faed9f0fac59277992837c5dc6de613beb3014fbb8c

SHA512
0899ac70c395220a370bc5e7cce2a74c9c171fe407277c876e20590ae92d9acec083dfe1ae5d6c5ac0f90d58ab6d780a8c19e158fda026304ba5d21f315abc57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcf4494664eb1776d45fe1d8e1e09de4

SHA1
d658fe59f091bab6383d1c795faf8fdb1b562b79

SHA256
47fd658770f9edf17242ad7e0db9ed71d9c1d241985b9c0b1549d8e31ada2fa9

SHA512
e053299a305f81f3bb8eb2deb5fa82b9cd35dd5091fd932a94a8fec465050262963a9f9e65cf393098b06e6ce7e7f40504bab98b7f28f95921483d50c2a16f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c51eb4621df22885d924a71bdbd67090

SHA1
d3aeec4b81f15a036fa168a1d95cfc0ad593d4c5

SHA256
3867fc82b569fa4d8a1e772d20838d4729e37ca1a4c1a078a8a86582130c3d06

SHA512
b34d69ad2c849b37a77c42ea64e716178b7b70f643071cf34b780286cb52ce383ec051c0366482e89ef405d32bc77e8a16bf6e088a1c95e80e0e01d23e3955c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf6393827b09312040f0ee81bb6b01c8

SHA1
1f506f756fd23b5b39b1837225f34594dac891fa

SHA256
a6b3651af242bfc1477ed4032afcc6edfee8b556cd0e27649939e3d9d986d01f

SHA512
408c50aab0c7cf6da5585faa74af06db4b566499a43fb2bd6f3ec8374f64541cc45ab881b4d2b4478de19d6261b9e1fe8590e02b9a0d328450c45a28761bc95c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\019b5856-50e5-4cd9-ae6b-50057edc4a27\index-dir\the-real-index

Filesize
2KB

MD5
47350571184f42c4f3810bb87894e8f8

SHA1
e57ab7ee8078f220618d37c914d026a7a01c33d5

SHA256
811f8d08752dbce3ddc0e19b7baef99a5bb82d07ea682a8e78beed29d09ce838

SHA512
d6eab992d5af0a16656b243de75906798e0581d665771bc30b1bb19b0918d961fb1fb9e820ded8a70900e2958c2d9bf51ba82683142b985670c2d791e7c4ab08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\019b5856-50e5-4cd9-ae6b-50057edc4a27\index-dir\the-real-index~RFe586443.TMP

Filesize
48B

MD5
8105c13620c4ddb60a53e358911c6306

SHA1
adfb3a4d1997471fbfd7711191aa48dd8f2ebdfb

SHA256
0a3909f11a07d01577f46faee113b2230abb3564aaa12572885e4cdbd1ce0cbd

SHA512
3a4a26a43ef66d17bdebd92d724f6860c31e169e402e703c7daff6b2d00c752f88631e7da4e935e5e96014713b555370d1c9d87987d6d846d1e12e473ebdc295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
33162d47de279a9e5257c2fc9dbd20f5

SHA1
d935374b68b77c5f7566c1b10da7356f92655836

SHA256
eef5086321a1eb0c39f6c5eaa60dac6321cf3384c8ef2a9c3494dda1d670c0b9

SHA512
c0d97e0dafa0d5f8c4d5fe8627f10271778111eab7a6e97cd616fb9eb8f70636bf2c8565e35a79bcb59759fac49e846291a63b574f29d22c7ceff4c87cd52a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
9ad4be0813b9c50dddad30aedaf17ea9

SHA1
c4202b105b8b5a1836bce877216aa89fdbc12e8e

SHA256
f2ad798461e3ed2617f6e4e7a1c266a3bdbe19ef957c6deb1e0dfc896c5ecde6

SHA512
4761dc9f72a0bfacb1e4ea4c603a5fbc541d3deed6c913a9cdd67d137d667c37a6278376b9d220a5e92a7f18068ab7a12dab39aa24150b1f5c5b224c3586bf06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
191480bfd2c93b4c1265fc1aa5029e3a

SHA1
3a6474b306dce309c1db1a5b37b56cee20f515a4

SHA256
9bc8cadc34e987a16e674695867c844e7c8c605821c1fd1007604e04365baa96

SHA512
0446bc30075b9e54665f02fa21c76865f30d682ba3a0369b0d1d063027a79db9f7c286ed9fd5fbbcd5b0df65b6ed1ed74fd4bf907f5c7d4d718711cf7c949786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
7d2dfc7ab64a9d5d565b7952cd7751dc

SHA1
d724f19db4a9c5f9d558f115d4e1deb265fd0224

SHA256
87d9aa642c2b6cf653bcaae77e973e9106c210952c3709a7172851875b45f2b3

SHA512
8f341e9ed3cca1455d3f675ee10c34e3186753c2ddb1c1fc16a86c6e65c68f052889174b735f57001c101b51727d343a72474e75b796dff8e83cd510722c4532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e573aa81c6dd44791c7670ba4aff5a34

SHA1
177838556a68c56393711b8713f66b46e9c4146f

SHA256
ed0636a4c3b50c33fbf421d8a50e505994271c0d05f8ccb10e6f83f159d2db6d

SHA512
3b6d046d49f0c8b3aeb88aa1bb54d57178dcc04eb83e020c79be6306d53b51d8c13dda9e8402cdba00a64a8297b86868d7a45f50e059d7bd53dd50ad6ab502e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585399.TMP

Filesize
48B

MD5
84813e480f5ff5b35924bdbeb08a0a9b

SHA1
3231a1384d156eaeb404423ff964d8fa50d115c9

SHA256
38789fef28774b17ad743cd2e8db7d9d15f4fb79887b87c3811cf95cfe0fcea8

SHA512
b1ac30626e2cb0713c5ab70a164fb5266b501d8c1cdbafd170f389801dba8fe807abf2d2a80f9b782136d50d567d3b5d91e1af5edc60a77261129d813ee9cc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
58be7dc82b1265a5dac3e95c7a377361

SHA1
800f90eb1469f0c28f37b0aa7e3e98b3b198255e

SHA256
17a59a3315a46c8e7465531a5da982f01d59abca1d6e31d71fcbe109efdfb9b8

SHA512
2ef598c92cbd4acb14908cd5f8ffdab983af25cd830d9e6687857e5f402456674b9d46a43248e7674da1bb1160ee74c87d2a8c98122895781951f87ecd393432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584745.TMP

Filesize
706B

MD5
5332dbf59f5baba4e02025c118dd68ae

SHA1
7141adc58cfdb5d80e348024193667ea95ff9068

SHA256
0ef19007489c7b516d60bd0bbf504f72021156dd7d8cbb80bd35cc601f4a0c5d

SHA512
8b24a80a40f21ac9077aa6a8b37e01309c015f4014a8fe6303114c5b893abee6c4ae580087cea8e1734560ca28f82afe2f5e52bd30e7ef4e4bc74f564d14bc79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5aa0cbbdcf35b5275a52bceb127107a4

SHA1
7b006b03f376d6646c3dceb10c7c6e04aec41b81

SHA256
04c02640ac38c94669e6ea78b461baf5f5dd1d4fd1e863d179872741756ea6a1

SHA512
cdf8af3c8c5604837bd121611afa451193a9df3d2a6a531dc778791b4f89c29fbdc7fd5d5346bf3a0d1dfa2ab1baa5c987619216031589c8fcd1e75758737f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0a5a01a9ebba2825feb721671e40a37

SHA1
34ac67ccf4466f92caef246d1e285d9c8d2f2a4c

SHA256
8d849fa2e5964e3c2ce0e731919ae6ad6b26895e2f7fc40b653c6f46d88067da

SHA512
de2d1fb64f5712ca7b1d6e59c002f1a8198dc100cba8193e809bb4a4dffd84fffa7566fc3afe06f1d5b8d0cd5aa2433610c22862bfde13d135573dc5a6368648

Download Submit