hxxps://www[.]youtube[.]com/watch?v=EuepnmRiSRc&pp=ygUc0YHQutC40L3Rh9C10L3QtNC20LXRgCDQutGBMg%3D%3D

Analysis

max time kernel
480s
max time network
485s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/watch?v=EuepnmRiSRc&pp=ygUc0YHQutC40L3Rh9C10L3QtNC20LXRgCDQutGBMg%3D%3D

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
3048	msedge.exe
3048	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1368	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4700	3048	msedge.exe	84
PID 3048 wrote to memory of 4700	3048	msedge.exe	84
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 2028	3048	msedge.exe	85
PID 3048 wrote to memory of 772	3048	msedge.exe	86
PID 3048 wrote to memory of 772	3048	msedge.exe	86
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87
PID 3048 wrote to memory of 1284	3048	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=EuepnmRiSRc&pp=ygUc0YHQutC40L3Rh9C10L3QtNC20LXRgCDQutGBMg%3D%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9657b46f8,0x7ff9657b4708,0x7ff9657b4718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,794642283383289724,7579838508085058430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0 0x338
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
16c4e53a969654b861622f01ef80374b

SHA1
fa4c3e5811254fa33fb66eb1e453ea7144bd0e65

SHA256
26ea0d05c08897acdfe4152ad51efdc0f1b3a8d924d620d19236b73135eae0eb

SHA512
d22fb7a138c9291ab72cdcec50df4cc111ec6643da628e9e60c0937dd3aafbd63fa20f2f2f093674f4afae8ddbaf8a4437ef5044d8f36cf08c9bec08e409ef89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1f0ff2791cf075435f7fa59b89caffa0

SHA1
76ef348c49223bc28bec15a55b3c0117c11f41cd

SHA256
6e5d9b13666fd3664614c29a13aae643388a42c5523b8b186df1692007ca6604

SHA512
b05ed7f41e159b52db0e2e99894098aed447d254a307d82b02ce4d4f7c9598e584d9d9104a8b8e15780d109c9990b83c7142585e27c8fd4669daf624c8d29eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dc0555017f23786e8d6a2d061f8aa840

SHA1
39d51ea1afd71d9554029dadb07ca1796a460b07

SHA256
a2e37f699380937bd53818c665c72578aeee781a90b7ee5b2482b9d4d5f747ca

SHA512
a5c2f5596f727f2471ebf9ca0409c2bd64db5c15bd768296a345383946a707b64281445b7f46e1359da414412f7d6e425493e1fdb9d69ea720574ce9f9372e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f299e238dc192465a1bbdc68373ff049

SHA1
6f5912f1e6d0ce7de1aa0298254a014aa14b9bbf

SHA256
c61d5ed5de5e76f719ffea23e919d20a1e325db14cddf544245bb6c4105095f5

SHA512
14a215c7e9b18f86ee67694dbdd8e6362cf21644a9e35e97377fbd9f0eb2fcbb70ad220ac4ba3a457b7a6db9b9d28ba252eed17fdffb1e946f357180103c5cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30b1cd59d01e40712959022e768f1ce4

SHA1
324680d221814740e08b75f67627c72500b8c8b8

SHA256
eeca0736e91769e694e1e942675ad67af34e4b27ab35577212a7a33451015415

SHA512
5b0f404caf0292dc794eaf4bfd2ce48f359a7f7d906cafcd9abffa4df0a13b267a317f8fb4e5797fb31a90db31d98a8611375b5cb761f81d392e3a0407b841eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
575f8aff0a3bda0bdd6b73f67018abcc

SHA1
940e88b68bc74e5b819e0f055a53be782505ecbb

SHA256
8265a0d09f17dd9fc80fdcbf08a9aeb9adb86e05549775c2a81e0a94cacca59e

SHA512
f065731f335c3a7c9adfd74cf426ce04d4c11472f4e2bad0bb2d5087ca138dfd2a4027bb0441630a1f18e0cc0cccaa03e783f046e5f21db750693c17c537777f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b7402d0d-2c3b-4171-89ea-fd07218132ab\index-dir\the-real-index

Filesize
2KB

MD5
69537971f4e1e80d99f3147b026675a2

SHA1
0f450f5b65a2bc1c80532bb26732f40fb6f0ef0f

SHA256
8aa2fa988fafdc6d88997ea8513b6717e5b54225ef211a263b11396f3d79421d

SHA512
bdee22e3a40338e586dd5eee1027469c07c026e47b0e984eeceed607587869305461ca086510fbbba405f2fc40d3446496fef79c996b6f9a02df575018423a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b7402d0d-2c3b-4171-89ea-fd07218132ab\index-dir\the-real-index~RFe57de5a.TMP

Filesize
48B

MD5
767898276c94eae0b5f06fea1caa1fd6

SHA1
2c14baf7136c90f6e193a1d2506f76b7019f9c2b

SHA256
2442c9e9bc7f3302449dbaba107d1420f75187eb454d14c43ea90fd5031c8292

SHA512
e28b8021bdf25df33319d21d5810367b2d54a36a64ea3e58504ab585c672a09de373e6e50490187dd178d07bb9b67d6388d4a402e76e6f8487fefe4e99f68ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
e7de1245353fa84d1cb93d69a6cc9c61

SHA1
5090b3658ed9f3b234840f2bfd340b44bab809f1

SHA256
f3b274b2fdc23e6860066872e9492717e12629e4fa35806b94616e5fdbec06df

SHA512
131d98328d7e8ff73870d3c89cebea1341bd8b7f4159fb19f334f4f2e1a456d6452bf3819e3d0f303f81802bcc1adba384afe5c92a977eaf1cf83b05d8252eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
3eef8f435850433ed8d1c89b2ab2034f

SHA1
5767550679063ac98165d0ab09cca10f349e6da0

SHA256
f822701f5aa89bf98d8a1a4fe90e31ef37c175e8efbf62c26c16d79d22fe2a31

SHA512
704680e050f5e32e4df3a1b22df0927be16e99e0f7d41d099f660d69e0245f9a4c997e7b7ad27b37e21395891dc611f418b9acf86cbc5d906bc1026a221ec87a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
ffa73c13baec724f49a36d85db3003a7

SHA1
f2d3ff9da962f997bbca4908e2ff0b6d5ed66672

SHA256
461b27268c08b46daab94a5659dd6d6f111347ffd572b8d07f50cb1d2f2c94f8

SHA512
4bd7bb7ec9186dee4da29b8cfc74b490a1f23f3f9d7219f608a896ae78970248dbaa5f71e401a8726f7b256be6f771db73fb8333fd8c3135ba80cb2561eae9a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe578414.TMP

Filesize
89B

MD5
556037817b4a00101ad809b3ff2db12e

SHA1
e3f876020ad30cce6c2224c52e66769442c7612e

SHA256
f36fe735188d7324d65ae546c5f0008b12aebb49aaf45e4c428743e091437e14

SHA512
e9d4e4004cd7adf3f5fc97237af1adf867f34d365315c0bd2195ced53ee09c220d77427a067da84a29dca7c2a84d52cee242d00e14f74857c76978ad2d5a6655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
393a86a709812dce20fc47718b45c493

SHA1
c84c88208376c3e6ed57a02724283ed120071582

SHA256
dab70a8ce94061a8b21f395c3fd2725052cb61b0586dd146fc60a4277c579463

SHA512
8403adcc6a96f83a7b70612f9959703b1f89da8d667ffab41aecf8ffe6b63ea65b74b06e679420a73566d7823d2b2e919b48a3721f03270138668a2db97f4849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d33e.TMP

Filesize
48B

MD5
c8430ff656c2ddcfac0b70bde5c2b3b8

SHA1
fb9404e1d64711d40a9e11495c48918160933c7c

SHA256
1413a99de62b7e6a63ab9e1c0906f5426923ead93b05b741548d37dc9763e911

SHA512
e78df6dcc39893f52b7b0f2a3695e3519854bf5e4e78dae00acba179ce75393d5e8150ce55c51a9597c0782d0454f540ecb347765312d6863c6e262fd24a9e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2ec48d0990c05a399f5cecb1a3e046f

SHA1
a419aa427f13e6f68d289db3d6c1292d7f52a988

SHA256
692db735e6ce0e929943bd21b0154c57a74eb093acb364560da7751b95a661ee

SHA512
6164aeea4ac63081ce0250c8cfc63e0842690cf093a6b30d2bc1ed781db4f64ef153164712a1cc08bc8359490ba8bbc10cc64f946f3845699894c89e77f4c2a3

Download Submit