hxxps://www[.]youtube[.]com/

Analysis

max time kernel
120s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3268	msedge.exe
3268	msedge.exe
2824	msedge.exe
2824	msedge.exe
1520	identity_helper.exe
1520	identity_helper.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2824 msedge.exe
2824 msedge.exe
2824 msedge.exe
2824 msedge.exe
2824 msedge.exe
2824 msedge.exe
2824 msedge.exe
2824 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 2752 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 2752 AUDIODG.EXE

description	pid	process
Token: 33	2752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2752	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2824 wrote to memory of 3380	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 3380	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4356	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 3268	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 3268	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 1072	2824	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc00204718
2⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
2⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
2⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
2⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3540 /prefetch:8
2⤵
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 /prefetch:8
2⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16801729139998947903,7571979580563038284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x320
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
e9b9298d06dd12c2a38045ede4b9ea4f

SHA1
3d2d62d644fb6a0be1898a758ee579e802cf78de

SHA256
1b94f04a988137f4557507e86d83c12edf2cf917c7b60274ea10f453e57f70d2

SHA512
e15235881513c11d731422e6d38f0fef63a2978eeb3ce2df3c7d953630e77df460c16adda202fb28c56f07c70505d47f773c18f5b3074b685d34cb16883da83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
b8c95f079efbc97f7e4ecb60750cdbab

SHA1
38519a836ed4a7181a135efee90e44d15ae10b10

SHA256
b9162541ae87498409f3e00cb8a1331aa619506d99358a5c0af9a90477295a54

SHA512
a1599ca246f0af0dfc03a66239d8a61f05b4267fae13e1b7709ea6e1219f25e84998bb254b493078ecaea3c764fb19d8a997c65bed03d928d07132e1427d71a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4c286cdbddebb7b10c6fc041f9268fa4

SHA1
c67c1134a801d06ec1f378f8c43beca690f671b4

SHA256
94af462121aa7e525897eb79a24a626b1bb828d9a5068e42ebdd2fe5fd9c42c6

SHA512
12cbfe29e9808e59cb10c167c6505335729ef483bc6ab84f43cd3e067df0bc0f6d33b152e3dd02dbd4914b27029905857256d32e568054ffe0e04d797f174ad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
811178f4bbd83bb132269603e69ad647

SHA1
ec96dfbe84d15c2789f284d9338521048d5e524c

SHA256
7bc0218d404f60247b310c233a1ea32085cb2e35f7718874e3fe079d7f416407

SHA512
7c224f72e1a1acc2cef185c898a62754324540792cb6aff5656af2b8977473fe9a9d25d1a07c5ee5fb0a93f73ff507d88c38cd9a415666177771841c8e9d544f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\45c05c4b-d2b4-44ee-ba43-2f5ca7d76a2f\index-dir\the-real-index
Filesize
2KB

MD5
6e195532637da40fd1e2fbd1a2f68e30

SHA1
29722c5991b353e3fa8afd073a4561751c26b0f8

SHA256
846d4d0ccab29b696d9ae58539f047f2c3422d8532377a34ad6bb4dbf2e0e57f

SHA512
cc6904353ca558a8223f785ce593caddd4868ebd0547b0fb362103f4e83558f85d231bff563c8755be1f94c8f74f3c70a709048c309b3afe055e9b91da9404c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\45c05c4b-d2b4-44ee-ba43-2f5ca7d76a2f\index-dir\the-real-index~RFe57b7e6.TMP
Filesize
48B

MD5
e24f02d0297ac5d4205c5b46fcf3a2f3

SHA1
8f8734e7a8d59872cccec36f39fcae47df092408

SHA256
214b96580a78583883c7ba96c73984b2b973e87ec3de1420d582650d0bde4226

SHA512
83deee153ce81ab259e8c29a77b2fccc08934f1b3a851c668fc136bdc613db032ff6d6394b4d62de30fefad1cb77bd3e57437ba4d631e997410e2c92a934064d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
3591a62c74a44e7d0d308cbd27e8b860

SHA1
6ab7dc17ff76f8381d18a6e36824031d4d145395

SHA256
574dd79472e0725dd949181bbcb8687f74a0bded318d1e8390e71e361af07fd3

SHA512
d1b6b62c1e261df9c0a110c481c7916f644b6f34f21e99e2d76401260a97881cdc619ef22b34b2fadfc4ba9326a8a8fd3dab2297b758285b011cce48de3a80e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
4563c0181906e976eddb463d343e3bc3

SHA1
acf49278d558b876c0d0e808e4af90ae2e2e990a

SHA256
3922be7714799f104f9e2e96beaf8dcc1defe91eabceb8be603d6e1750c723bd

SHA512
ed15b5df4ac37cd705b55cfcab108c25362efcb6eb1c332b527bd041ba6c65beb5e81409d53c6440516efa8934de5e7c1d8c6206fdafe4cb7c8c11bfa789bb27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
84B

MD5
d9d2ebf5ac47d84aec8d8c6fd7d1c7f5

SHA1
1a0504fdd403cf5826f8ece3ab629d4472215a81

SHA256
95dca8a603fbde4137d89796b58f05fa721785ba4fc62d5cca23aabf359b0f81

SHA512
11b811b0bab4dfc72c4de0e8e9cb66c9ecc9e3d1349d53abcc2a174c94d4b96f5ebf8e92e9c553c036a51d3cc04a7fe582d00c76b9b2eb49abc23cc67c10dfd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
9666e7450a82c204582beaee0eb82776

SHA1
12768b527ebdb3a59f89d6dd4073412d39a3fa49

SHA256
cac5f77fcbd72598ec08dcdeaaf293628fc84506bdcba6b2d795f48669042c4e

SHA512
04a7a4ac7ba0505096f8900874425191857ab609bae2c9ad2db95edf6c81d65c61e74a4576bcc4400b517e9328767eece51dd1beb5fe94f65897f49a6468f176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
0a0b3a7c87f7ce848279ec604f45bc30

SHA1
24e6130f84fa37ddbc052d1a0b2e4afa5d7e0ad7

SHA256
0451939f762553b8c4705b26c50e8cce3b3fb1f1feef89ad2dea02809e876e26

SHA512
15082b0ec94f7a60ac0ee4d9bda754f836f9f53aa744e587dec86cd7c1958304be51ee893f6947f614b38417e80e8ef345f4fb30cb92baf6931693bb35497021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b16e.TMP
Filesize
48B

MD5
7fc945bc784d2e86ae76920a27e5dc34

SHA1
cad419531062ac03274a1d1f26d1d390b12cf54a

SHA256
caa8cc5d68666de44d7d567cafa3081ea605d662cfecbf1d96d445b3b3eab11e

SHA512
be405cd94c33863736e61247bb3db56eefb5c6aa55945574c27b307aad79ce16ed7ef51b6efc428710a52ee38ed0375d96b085607eb95c60e79b3b1e204b0b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
73720cf4a192dd78a2698bf273ee0649

SHA1
24b11b9e9b7faff5b406c748ec6a279d6a5c513c

SHA256
9bb7b28594eea590553d5c0a34a46a187273902646cf6e7e5317a440bea50242

SHA512
bd75f2b4e3f9670965c320e4de23ec94852581ba974eb813a6752291712c1217e51bf119b215cc0d74e5bd2415e74c7f4a906652ef465ededf8e7fa155eee3ac

Download Submit
\??\pipe\LOCAL\crashpad_2824_AVZJVKBKSYQKQCNX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit