hxxps://www[.]youtube[.]com/redirect?event=channel_description&redir_token=QUFFLUhqa1lHOXVJbFZJMDdTR1YtVC16WXZ1OXdzdzktd3xBQ3Jtc0trdkhNdDZuc3N3QnBPMmRMY3JxbGdQRzhkanNoM0oxWE9waDR4dnRyTkQxSWhveVhWRE1SbEdKeldJR016T05teUJ3YkhLRFFhM0VJLVZ5QnFjeWtPMFFsaXdlZlkyTUw3SWViYnZaUVotTFJ3M3B3Zw&q=meetihere-spicy[.]click%2Fannanaa&html_redirect=1

Resubmissions

20/08/2024, 13:14

240820-qgwpvstdkg 3

Analysis

max time kernel
38s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
20/08/2024, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqa1lHOXVJbFZJMDdTR1YtVC16WXZ1OXdzdzktd3xBQ3Jtc0trdkhNdDZuc3N3QnBPMmRMY3JxbGdQRzhkanNoM0oxWE9waDR4dnRyTkQxSWhveVhWRE1SbEdKeldJR016T05teUJ3YkhLRFFhM0VJLVZ5QnFjeWtPMFFsaXdlZlkyTUw3SWViYnZaUVotTFJ3M3B3Zw&q=meetihere-spicy.click%2Fannanaa&html_redirect=1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
1616	msedge.exe
1616	msedge.exe
2928	msedge.exe
2928	msedge.exe
3008	identity_helper.exe
3008	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1012	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2016	1616	msedge.exe	81
PID 1616 wrote to memory of 2016	1616	msedge.exe	81
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 1700	1616	msedge.exe	83
PID 1616 wrote to memory of 4560	1616	msedge.exe	84
PID 1616 wrote to memory of 4560	1616	msedge.exe	84
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85
PID 1616 wrote to memory of 968	1616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqa1lHOXVJbFZJMDdTR1YtVC16WXZ1OXdzdzktd3xBQ3Jtc0trdkhNdDZuc3N3QnBPMmRMY3JxbGdQRzhkanNoM0oxWE9waDR4dnRyTkQxSWhveVhWRE1SbEdKeldJR016T05teUJ3YkhLRFFhM0VJLVZ5QnFjeWtPMFFsaXdlZlkyTUw3SWViYnZaUVotTFJ3M3B3Zw&q=meetihere-spicy.click%2Fannanaa&html_redirect=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffffad03cb8,0x7ffffad03cc8,0x7ffffad03cd8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,15974101150864866226,6740902631706701087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
6939aaf19ee4f80279868e6e83f8f6bf

SHA1
4201f3dcb5c1eebeaf743da6f53a24bc2e3c2a1e

SHA256
0aceac08add98c3e1d224b4bc7b550956e695534c7b8b5465f044c7a7848b4a1

SHA512
1832d768404bd45703686dccfa7c5aea6e593980645adcd97a4ad9df2e467531d250288962c20b01ec589bd7846d61607268450df119042a40e78ed807c06741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e17581e3f45dc9f279664f2297eea18c

SHA1
18c6ede1dbe656a122514714ec4c8f91c8ced5b6

SHA256
a3fbb51d61eb7d4acd58a9188a6cc423e12d1ec3ad1c4e5e6631d610eba8c0eb

SHA512
10bf146d689e5dc6a7376331da4cbc0bcd7747f5d3b5d034ad838b41a446f11bc1532774b0add70135669e8d9e3dfe175a6a521a32cbe38addf064bb98f1efeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b55d25c7428924cd18691e371659e0f

SHA1
35f32ef2b4811c2e9eb90d3fb77c3f03ba33efaa

SHA256
04eb619f17879a96983d5fe49238569dd627cdc7fec6e6fcbd55cf2f7751790f

SHA512
1fed5200b2a8cafff5f4e4e3162e12fa9898526e4c8c962fae0a6f4fece6185ef8634d8364101bc7efda8da50bd7a61f3d7f594ef66a7eb765311878386359f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0830417f-7fdf-4aad-8132-caf5548bd538\index-dir\the-real-index

Filesize
2KB

MD5
c8f3c54f36b6970feef3be1f41e993e3

SHA1
cd1355bf107eab345991b19fdb583510f5f99281

SHA256
facffdb120647c964ab384f13a3957dfc2ebdace679ab205b0ba4b20f6fbf58b

SHA512
ec68c4f8a818df55814ab5969c22cbcad2f44f68a4655f7c65693b21b294085a915d9fb2c69ea1602af69f8f0dfbec9ae0928b797c4022417e580793cae5f5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0830417f-7fdf-4aad-8132-caf5548bd538\index-dir\the-real-index~RFe57db0e.TMP

Filesize
48B

MD5
5fb6ac8145dc81c5b3aa1429d4a3f588

SHA1
7ebee7c2fba2f0af1a64b1734cfd8e305c9207f1

SHA256
b6576eebcadf81dd2d45dbaf6caa90a60364ced8eca84ad24f4258951341ddb0

SHA512
1eb0a226d9176b0a9caab81e834f524362e3af1298ff8e3f253ad86f5a5bb1373598b311d61d68412dac8a81a6adb36776652038095f1bdb9225ec9c2901fafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6656ba45-6ae0-4cd4-8ce7-04758c73bbd2\index-dir\the-real-index

Filesize
624B

MD5
976c382670dc38fae1f8c773a5e08757

SHA1
b29feb976b9aa6b7c8d970c7f561575c84c220a6

SHA256
f42d915384c9b5beff2eaf665720ccbdf10b0fc2758c4fed3b804d344851f137

SHA512
06caf73f37c10741ea00457e29fbc04fe4ef439effd5b2f9cfe9e904e051ba0add0f66416e6e1142f9711bc5f356dd4f7c67e033500d5d70ec8ad094a5f1e3c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6656ba45-6ae0-4cd4-8ce7-04758c73bbd2\index-dir\the-real-index~RFe57de2b.TMP

Filesize
48B

MD5
7231f52e4cdf38119633bd97e433d899

SHA1
fa458187f9e6d34938404cdfb54d18d399b4fb64

SHA256
198846ec22afc07230506d812db36be5c97eec6f06329a665f3a90b19d109a6c

SHA512
4a66ff83475c9c62a8513d0b13099964bfac36419cde47c20f62383d9ca96aa47b57a8732160bf25257a02b3295614b4a2b56ea9aa776e9ed0c93acbba1eb5a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
9a1cba4bdb21271edbc236f1b776aeed

SHA1
ec7f103e3c4b8152524150bd0e10766b9f00f0b6

SHA256
d1e05792fcbcc83e64e4c388bcf60617e988ab4cf8a218f6f52ce650c16e5478

SHA512
4ba7705c84f3ddde83d4a1fe419f7f17621af32a005dc461e53adbcdb713e09b121be9b1cd8f841245344fa9c572357ef88bd8c69b2300260b510c147bf40b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
fd6f4cda9510d9a2940e1abc6d8aa971

SHA1
54332e3358c009ac4d03a3c6ca9090567ed1ae57

SHA256
4e73220fb4d8fdb8e05c07f0dfe7821292b5e382457e8caaa2986c5afe2e1ace

SHA512
9e5a8b0d2c13aae8a93c7aeacd4f60bb91e6177f042fcf928175b1bfcbf4bea626bd1ec343aea3fa909402ec1eb13a64758d0a9256509053f6d8ab1404117d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
1f11f863ca4b440e6c94051141c353de

SHA1
4c808d8e70d014a0bb8488d9d0fd38ada63076bc

SHA256
3ae9d934eb4b222fbf3a4b4517958b462b169e2465d46634726b024efe89e63e

SHA512
122ba75d30f7ee0f6ad0259a217d7f62fe89e2a8fe26bcbe95d8f8faad97372d5992e877384e8bbe696b4cf2bd07a66d9fedaad6535c9841ccd81d3a51893962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
740681ce0d7167137ced2c436ada71b7

SHA1
5bdeabcf308ffae1785cff399906d7230457bc64

SHA256
26574890939d7e228c84ff939309f38526180ebea23317d8493f3dbb6f53f193

SHA512
a71d9a112a4ed327b17c3733070f94429a0747d2843cbc15f2bfd0452a12b036c69fe4fcf355eadda57dd7ce859ea378a335da5148370284d8f93f785066ff54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
5bd7fb574873e0c25ff998767f65cdfc

SHA1
7b073965015cfbe1553374fc30d807351bbc656f

SHA256
9ff08ae28b3e738bed93e3576f8d9e3f0770cbd2cb4d137e55bc411bfd7d25fb

SHA512
dd11c2dce154da4af6390863a7087307c1b360a0bd0c55f03b54cc7d2130c95c35b0bef54d8d875204e76031b5a324bd8c8afc443b8f96bcd51988fa39c09ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a9926d797ca478cceedcbe3385992fb3

SHA1
bc8ce7faa8be2cefb2c1c5a819323b4a4d7f55d9

SHA256
71520dc89e352ae50115c7178ec253a6ed25042d8905c40590eff0cec3052bf7

SHA512
fad7a26e2f7d9ae9383e6824c9a4a2ca3468f9358d4b3964269552890076802f1a223abb6257969fa0365f2af85896e30cce8673d1cfe26b916adef18a402b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d5ce.TMP

Filesize
48B

MD5
82e53e50d61daaee65950a061633b9f4

SHA1
e060791f50a7fa1edaa0f2e9eb77be9f03d4932c

SHA256
3834c79c819531688dfc5f5ce0e7ccda0d145dc3e19079565cbcea1b784ddbc3

SHA512
25f9888825db52d2ff41aa276d17ebd6d145037f7669bc7046055d750203f662cd18cd687e22e861e31865181eef7383b351722edee52f223d379d47d6511651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bf8fb626f9c9adde203e7b43f737bd5

SHA1
01102e43638707ed8112b64eb2535ed10c9bcc93

SHA256
28db6a5737a5a066371da14b847b0beaa96f1370300afcae882b1f0b455a993d

SHA512
d56997661dfefaf7405ad614ffa3604a801a8240f3dfba2a313248cdbe13adab79b4e6da4b7e99bd04433bec22f34c9bc021fba6b8d65d65da1cb0585a833339

Download Submit