hxxp://youtube[.]com

Analysis

max time kernel
65s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

2092 msedge.exe
2092 msedge.exe
5088 msedge.exe
5088 msedge.exe
4424 identity_helper.exe
4424 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

5088 msedge.exe
5088 msedge.exe
5088 msedge.exe
5088 msedge.exe
5088 msedge.exe
5088 msedge.exe
5088 msedge.exe
5088 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3964 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3964 AUDIODG.EXE

pid	process
2092	msedge.exe
2092	msedge.exe
5088	msedge.exe
5088	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe

description	pid	process
Token: 33	3964	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3964	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5088 wrote to memory of 4520	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 4520	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 220	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 2092	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 2092	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3680	5088	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbb0846f8,0x7fffbb084708,0x7fffbb084718
2⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
2⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
2⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
2⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
2⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
2⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4976 /prefetch:8
2⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5228 /prefetch:8
2⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
2⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10876430953555964306,15547843837536884009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
2⤵
PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c8 0x450
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
114531cbfbb71d0e27a892f649f99623

SHA1
52621b955bd705aac58565ec37ca6186366c0695

SHA256
b4b6beba028f8756c1af3daf2efb4c64bc6ae2e93e6535a5e67dce7533046254

SHA512
64aeb43ab0b785e85208092768bb4257cc35f014d1546b232b6d201e4b06dc34c11808346fc62cace88e6c9424c1f0805ae6440c21d16e8059bd97c43c24b3a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
5914d475c7b03df59325fe7261cd9e95

SHA1
d055476895a23896b9d134fcbb416116b34a6545

SHA256
4d492825797ccc8438080709a3e84cea1a174cae1da691606ab0af620d687c18

SHA512
d603d46a5a2488346b974f31969f5ada7891bd9c5070ed240fc3513ee575b1c12f50def8d1358d7bad2b3c7eab86f1da318dba0f5ab40f54354e36b043d88a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2d78fc79b5b8923a1ee37ae108fd4111

SHA1
4be5cc182cbb28f6540365fc556d9db265f0b84a

SHA256
c84468a2e458278cc7e859c05ca76f05b19401baa63c5f592c27cf811cd38133

SHA512
186308d03b2ad7e7aaa66ee427d3c27db6e151a67410f0253f16197ee130f57dcef75db40d7abc6f66a3b602a971afea7cb2a53e56db0a875e1fb2de79b04b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ce3967ca-f729-4da1-b648-de50d2d144c7\index-dir\the-real-index
Filesize
2KB

MD5
21c9124ce5ecb0329b77bfbe8f07b0ce

SHA1
5702e73ba5a4d48a1c3a85c762222cea7e623076

SHA256
b748f0faa96061a92db31d3bfc33d693dee123b2006e26ef0af6ac059a475881

SHA512
6a41fd45c3bc3bd324b531587ace1293f9017486dd13ff67b1dc88ce9a780a03de8ddd36295ce7601570c14b8e319d361c28b013f5ed35de98f50d9e46838d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ce3967ca-f729-4da1-b648-de50d2d144c7\index-dir\the-real-index~RFe57af3b.TMP
Filesize
48B

MD5
ea89afca8960d00155115f58bb50fbcb

SHA1
c214a51ecf6fce22d52f9b00b483b124fdd78acf

SHA256
215ca32194d8e63b1b41cb01c651284257f844a81a29620083b18c76d1cc81de

SHA512
9ccf82c7452d6681c4c6b471a342fefeafe6f47b66b5a7820020103dd20d045d10a7325e755a26ea52981070587d4970b4ffd46c0acca3bf804b288cd6f0d41e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
3fe31ed257fe4fd55c69a40daa8cb1e6

SHA1
3acf826cfa927a7ec85922864cf06630d06347b1

SHA256
ae0611ad349b8ee191785c837b24dd7d746aaeb2276d41f9770dd2911b52036d

SHA512
6ed4887e915bcb8be302bcec89cbbc98f17b5d9c1501eafb34ff63ba23818ba63b20cf9e8f8b7eabcf016b30386a76fa1fa8678834c0ac6a54c93a7b83d2aaa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
788802af4a2529e4b4797e3321b1fed8

SHA1
5758f33d61cc914cb4f1cd2a6f102b519c611cec

SHA256
5755ef2538af775cadff8b510f23c6901d1e2288684bf74015e12c10a457ac85

SHA512
8bb2c6ad2363f2ba75125717a1941f8ed0f79d2c111b7da2146750e37c4e95aac651ad22a5b8383d271368dd96639177e027b9ee8e83f68d538e7effcd3ed043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
84B

MD5
2b550215dc8ccc213fe6854337f6747f

SHA1
7788c428674e69acfb32003efba3343db1f17fdb

SHA256
6b2068a8486a2a14c19f87dd30cc65916739d068bfa3d63bca417a47e37888a5

SHA512
cc506ab7b6916df92378ed76df115c17603eaeae8ef38dfd09c54ec92b9084723b755cc73d30db3754c2cc3ed7558f8baffea9582b128f329d2e78e9c3373572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
cf5da63c427a2090926b46e6ed20de08

SHA1
66103803ff5b2969c9a4863f23f397bafb6f74ea

SHA256
031aab6adca8987351e0eecf46b1045b9b9866dd130469b47562c44baed2ab8c

SHA512
ba119b695d6e69357210f995ece880407deebf5ccc635489cb49aca5ba4d0e73010b8a4005abb10a415369c318b8021c2d1c08820a7d2d2c8c44b1acfc58ab0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
74ba060ab28dd352d5190cf7c28c5094

SHA1
4dfba65e891929f2d205fbd8b6577e5585469cf9

SHA256
cf08699695cd8a06e42b4bd1b879526913f17fa364ac171703b48e0959054da8

SHA512
1df9aba299b95763a405ec591c3f4be0d63ecb3434d2eae682f90ab601f2d6e7071e5c5f386f64b078fed43b54d4a292860bd30387e61355fc29c6dd913a0eea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a8b3.TMP
Filesize
48B

MD5
8314f8197dff59a78423b5daf67f1f2f

SHA1
47543e06e6243e50575b6c0cfe50beaabc6dabe7

SHA256
b512a90854b855fba3387a894eafe55d5a2809ac7a9a018ae87ec7955582a587

SHA512
a2163303aa6400a42a71c061917b003993ece09f91bb92e8538b4147e24d68858305e1f0d8eda1b65f8543924f61fba84e7de8aff5875a2ce95e041c9b0e25d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
f1e2d8588598cf2736402d2e7316d810

SHA1
660848b51354bbef1a8c0e158f529a8ae15295cc

SHA256
271ddc01515e34991c9fc0084cea036c2494ec2c75a6995c0df09fc78b152aa5

SHA512
589c55784c668a196e385da4033201103d0609899ffcb0dc839b0b0883f4ddf48af37a8e9a0c4247795e1e327942cdfc56fcaf6863fb8ccc9294c3eac67f1fc3

Download Submit
\??\pipe\LOCAL\crashpad_5088_TWLEWSHUSUQAAWLV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit