hxxps://youtu[.]be/JskfCRCecdA?t=202

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://youtu.be/JskfCRCecdA?t=202
Sample240608-ncdblsba8t

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
2968	msedge.exe
2968	msedge.exe
4080	identity_helper.exe
4080	identity_helper.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1032	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1032	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4100	2968	msedge.exe	81
PID 2968 wrote to memory of 4100	2968	msedge.exe	81
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 5084	2968	msedge.exe	82
PID 2968 wrote to memory of 3940	2968	msedge.exe	83
PID 2968 wrote to memory of 3940	2968	msedge.exe	83
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84
PID 2968 wrote to memory of 3512	2968	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/JskfCRCecdA?t=202
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffd092d46f8,0x7ffd092d4708,0x7ffd092d4718
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15154103081877824157,4021419602453992813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x43c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 39fdfbeb76f7e3f47efdcd280a80cb0a5d46e2b538aad567bc9978fc0da0db89
MD5 4a2f03b6268c09f5db63ecf57a0cafeb
SHA1 d9055970ad862ddfff05083ec259ff14b84100b5
SHA512 e27dc8186daf4c739bf3d3dd47bebc7b53a77013d704e59b804ef3564132096acbefef1c381d3d6aba3af04cc7b71ad1b2ab02f30e46a85802df5bd2703307ed
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 0989004e9a3fc8b42c4bea89862fb56db0c94489420b25ae7cd6f88d182ac495
MD5 3962cb86c44a5539c785e85f53cd1325
SHA1 9de39beec6a842b75134d7edaeb8a7b27724cbfa
SHA512 adbd5bec9a4e53fdd9882a214638725ac5aff7bf2aa37a5cb1a5bfa3c8db03e23bc055e2c1027d75588c0d69844333b076f703624e9db2346192f11263fceeea
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 7f568464b628668ed0a357a4e1cfb72e2172c71012b59ca36969580833e1bb3e
MD5 5a24ebfdd4ecad08e1e877469033a607
SHA1 b4640774c29e5f642a4a5a3209b5c0e6b80bb678
SHA512 98d2f48d469925536b65ef798994b09997b1486803acf28aa9be6b61d8c46ada84d0323e653c19d226e1f4c5f90815cfe8eaee28fa32db2a8ba79d95d6dc6f3d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 62b1de79dc93b254a1bfb12290e693d90dc464b7364a10fb4377e370f0c9fbf5
MD5 3684c79b7c6625cbd31919e2e99857a4
SHA1 7067785193b2d8139a2e6ef3534473ecb0bb7e6a
SHA512 6b02da5d80cab254ac003ac48d1ca3976672a86ab1300be033f8be2e567b2fd919fedc5c89d88191d64827dddca96c11179ed6687e00a1c98f09524563b30147
SSDEEP 96:nIIkhYJ1lv0wpvWMoiVmdeH/zdNwoUWQyV+VDCziEwb:nIIkOJb8GWMXpmoro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 26467d7ddf5c4c6b7e1df373397db3960267e82d68b89070016a75c02fbce948
MD5 3fc74307e9bb07118fe90ce0667947b9
SHA1 e3691608d15930e17982fa64029dee78497deca1
SHA512 537a0899d4ea6ba86528e4485acffb01a1cdd77eff4c5bd7fd79c28ade112acfeb7d9506f87cc5865b14b82bc1ca8690de820456fb05366a1a0d429297416842
SSDEEP 96:nIIk2YJ1lv0wpdhGobUHWMoiVmde6hMup1ieq/szdNwoUWQyV+VDkDaAiEwb:nIIkFJb8YG0yWMwMupAeqExmorE
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\41328567-6c31-4d2e-bc46-ce1e0a12e512\index-dir\the-real-index
Size 624B
SHA256 eea59c1cf151644f344edc42ea39ec32d993bec96efc822c12baa30612a6ddb2
MD5 99a7369877ca812554ef5983ddbd9cfb
SHA1 b69b8208f2a31ff2b047eee7d9be12d332a16044
SHA512 7a180c7d73082501e307d0c45ac00ecdd65c0b7d7e095a16c90b73bc065131355e3ae76f53e305cd156e656c99b348d64e7287c1fc6dad25420161bbe995c4e1
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c93b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\41328567-6c31-4d2e-bc46-ce1e0a12e512\index-dir\the-real-index~RFe57c93b.TMP
Size 48B
SHA256 3cbb785ee6d68f0eb3e21b5c5c31df30207c78940e8685bef931f9310236c04a
MD5 00fdf0db75f3b4d0213ca8677f75ec05
SHA1 f3b0b45423a398c798d3996817ba69295eec7aff
SHA512 eb558a9b29e909104d69530ae90d85cb88ff6d3d4b5251e98b8a1903004c2bc8ab68c22a9f435738daf1c4c265cbfb243f2a00281594b7593557ce7190d90ffb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ee0d5170-4d14-493c-b9a7-bcafd1acf4f1\index-dir\the-real-index
Size 2KB
SHA256 9db92712dc221fcecc24742b435f2be67c29d20188df89dcb8987fb18e0c83c8
MD5 8a8fb1451352ccfbfe7c5dc5a4290cd1
SHA1 cc584d4151d8c6a92adbe25c3ad36942fdb39e4c
SHA512 01665fc22feac9bdeb34777d552f76bb2ce2ba468e21a2ed93fcf46dad9e91e2a5b3f7e2a34d074f6019c6d8732ff83c58c4d0d6a34a022a85ea7a6b2e36db19
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c60f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ee0d5170-4d14-493c-b9a7-bcafd1acf4f1\index-dir\the-real-index~RFe57c60f.TMP
Size 48B
SHA256 f08f4d74a0a5e91964de923fe1ee82175be6f8763cf58fbfcba07e69dcf9de05
MD5 e01ece7f21d31e3f8ce3aa2d240210b7
SHA1 a7d99ec2d5a89e172209986703912dbdb0705de1
SHA512 8405125f60693f2ae138911ed5d150d292fd1af8ddd6455fd0b4840e308515a8b0ca10fbe41b2c11af27713b2cba619e5b3228d4ce73050f159ff83a47c6463d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 66e22fb6833987bfa947f09adc1234e07d19454e0e31823612599cec578c6b47
MD5 7f849622314302e150c77975ddd3f7a4
SHA1 516f10738d15fcb2cbb0f0edcf6f6215c8710b74
SHA512 15e83789d56411461ff6bfc80996b6d0aadd429fd2666ea8dedc09a6eecb835f38a10df91c7a036f61e1fa6a2fe541c47eb181cb094e2c0277ada4efe7da2ee8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 b38fff3d23ee526e40aaec96bb02001b120b06fc9e06507824bcf11566728bcb
MD5 c12669fa2072b4ef8dd508f4ddf0561e
SHA1 6e55b22203a38543d2ed3fc94354e3ed55b4db7e
SHA512 f3759adc3ec455c6779ce1b495211955a7d42a706954ffbaf3493ffef43d67030c07ca75790eb1f81aeb806189ac5b846793cad85cb87a4ff2098d0433ba7b66
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 155B
SHA256 7506a3e691866369c0b2457626adc977d7c1a05adb5011eef61ce4ecfb78321f
MD5 e74c04e37a1296f255464fb3e5143913
SHA1 43baf8c7dfe4d7f2bf235b4daf655e09d1571919
SHA512 5e870abeda9879d0156023856d89955a1d040cf7a62e8d6409c683211c1632884769ec2004484d6222f1393c72bee951170a57978e1a4f6ba246c51fc45d527c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 287edc3e40c37c7ebef6e426a8b7ebdb9b49714f77d4680a75dea968b3d7dd31
MD5 1834234064f6dfcc8d5d226507f1f201
SHA1 877b4bba73c4c8e5f844d04431f75ae13303ab44
SHA512 a2436396883b37923603ddb5c4556dbd8ed06eb024708c45ec9a06affc935dd9030c9b3798c38d9abda70e5f8587f30c165220804a591aa4d20b65ac160a41f1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 153B
SHA256 addd74ed40ebfb46f5805384cdc68ef5a32ad628dd7ace0889f248812f579f0c
MD5 ce24bee6cbf7acbbe5e4c61b23ce6a6a
SHA1 bb57b64abb0dbd95ca1b4f70666214cdfe117e38
SHA512 337305fa5b30ed894990ed10f65a6b9c92c68a85626054c43253325bf3a5063c0f6d4ecc1255ea5095a9808c26256a8624c60b1b6e5bddded24ca0706657c7cf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b1cfb4d7f0d2f69da8f68f0d1eab3b95bb5b9028ca49f9cfa0f9a6c5ded4f9bf
MD5 bb5335eaa26bdfc898c8407736b7e978
SHA1 e1c7b47ff1c9d84f950c51527e7079dc7402a7b8
SHA512 fe39dc1fc2e81204224203d5f08b4ad209ad097431ddd016c819346778ad4c6295f9440584384cd1361a0c6f4afbe0e228189b41d2259b2d80ec6cef727c2b2f
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57bb32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57bb32.TMP
Size 48B
SHA256 ed96707c7aed6598fb5fd9ff4db082e6dd09ba734f3f27a12b3e76bd0a247064
MD5 132d0607b0773a5da473783e75f7bdd3
SHA1 de77174840379aea582a8e118b445b82381876b9
SHA512 a7443fe4c00108422abb6bb4d23ce8f97f146df6c8b1fcd98ad0455cf1085427b44fc1405c13e08ce78259bb8221d13b061788b397d407cf567a1061abd50a6d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fbfcbf69637d566e8f0ab8e3e08dde07a9a81a4f47130098e3aae3272cbe85d7
MD5 65107a5928920654ac0fdbbcee4f8d9e
SHA1 80dff22cb8e70eeb3b49cab240609f28b3a55fa0
SHA512 69e39c4d97d4656cb84e9d63118977f9785a896010db4719a1bb323c324c56b1493522c8bbc068444ce3880cf81282e0dc2ac722dad92fcb2aedf791f951c14a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8pDvIRe2RUugNmyp+3z2Of:A9iIxuERzA83h09RZxYiGEQaOMWRHqlW
MD5 SHA1 SHA512 SSDEEP

Submit Download