hxxp://ytmp3-converter[.]com

Analysis

max time kernel
263s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ytmp3-converter.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
448	msedge.exe
448	msedge.exe
5336	identity_helper.exe
5336	identity_helper.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5432	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3764	448	msedge.exe	84
PID 448 wrote to memory of 3764	448	msedge.exe	84
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 2240	448	msedge.exe	85
PID 448 wrote to memory of 3768	448	msedge.exe	86
PID 448 wrote to memory of 3768	448	msedge.exe	86
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87
PID 448 wrote to memory of 2536	448	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ytmp3-converter.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c0a46f8,0x7ffd9c0a4708,0x7ffd9c0a4718
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4278420772156894823,16837454374143895645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e4f7aac3cc8227ad81584c4b6348ddad

SHA1
42c24884cdb20589af09ef90e6263079effbb6f9

SHA256
76a7123bbd8577f6f5e4b077851d3a47c7586af813fccb27718e58125a2d4378

SHA512
d443309b25b36cbf099ffe9c80f1bdb55552756ebfc72d947ab2c3fdfa1e006e1996ff4bbfb146b6dcff3776373141d5ab662ba31eb0f00509d256e21e8a06b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
78b3400d84ebfe0276ab7a18857eb532

SHA1
d9b160d36e762b7d6590dc88902baf7218d0c3a5

SHA256
dadd78888de7308bd0bc8985aeba19f127fcbf8cace2f5d09e16c092ddeb0f3f

SHA512
68f9d3091aaae85b385282fdc35146a579b2c4227e5a46735ea851a72b2c4a787b50358d8f74b4b2e9608e378d53544578105d4707faa0c4bb6b0996ffef234c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6531fa0126945b013a530ec36c41ea30

SHA1
89c0b82172250f2e55f62ff8a52b6fce5d0ac978

SHA256
b9ef8497f1d41aecd72387d2742f9053310024b731b92983013916b7f7ce31c5

SHA512
49273579e256db810f224d825ee840ef161823828161522b35f03bde5d6f810958214396914bdb6841be17610873af78d41db926c47f3def1d7bda0a4c4ef4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f346a20005c5dbe227d02c07082d7fee

SHA1
9b243d66608810cf0c4282ce452629788e101065

SHA256
19d8993633617756c28055abe9e3bf8eca58d2370635a7bab4d0904d86ff6eab

SHA512
213ad9e142f2bd762d94c8809118d9baa836d4f9f78364a1db34a3e41ae19d6aed8954b771006de57830c6356a49575a598d53e6ccab449329be3e38528b73e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4b9714b16bc3d4abd92cc22e1119b01b

SHA1
88b3a5fddf149af2df067787ce83dd89025fa486

SHA256
b158c2e861fe8c8c3d79f4cfb01e863d79e3fc845bb98279ebee63099ac3140a

SHA512
7181e6e2113f5a02dbd2063ec9ed96bfab316168a64f449db71f29bf1f792c667f6c43083690f3899878f8f18ea588f4accd57ba610caa5766eb52e280901801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a18209966fb40d61b3e11bf3d895b730

SHA1
f4fb628da3842b75e6360ae974d88df71c7fea69

SHA256
545f7b45758e35d933b7026951da21e09df025a3f89d9a77635d887742d65201

SHA512
67af3c26a73e534b5e464ac662aeda13422bcf7beb77885c4e7880ceab8ade6c13694ac9f34474458223611876075a7ee02e2b7fecc82b2df3aeb311abe0586b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae064c9b57196df60d759596a4b98acf

SHA1
645ba9b23a569e58239889bbe017a1b0e755662e

SHA256
2c9483c194142127960cc5dd3779c21c47f590f65a4efd561c16c90e85a887eb

SHA512
dd520495913c4531c689380996a4f32b217297a69df3caa053f2c79403f47e0db7e086e179d4e878e844e09ab90d7e19d9a84a83283c7c8674c112cb017f753b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a91afc63-c302-46fc-855d-1e85304a5029\index-dir\the-real-index

Filesize
2KB

MD5
49de003022a6496428ac091e8a69e113

SHA1
b91c4cb83a9ddfdd4e61f6276fb4a1b78ce0634b

SHA256
23d8a91ab7420c2c106fc1e2b2a7bcbd0c6cf0b20dc92c243d0a7ebc20cab31c

SHA512
06527db2de26983eae16b8dea74cfa0d2dad4bdc5dbf4d413bc0a6d13d6e243e4149feedead4c7dab96f21b5885c0492a3b359830b9d328e299baed2ffd8787e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a91afc63-c302-46fc-855d-1e85304a5029\index-dir\the-real-index~RFe582fa6.TMP

Filesize
48B

MD5
407bb5c5895d6172085e23a12061668e

SHA1
16e8edf68472185a73f76d81e2c3169a313b1cfc

SHA256
656daf5ca44ab83600aaadd530d6b75ca970b742310c8c958bb7a86bf0f45e42

SHA512
c0651e15bb2adb98c24c4b462c5420cd705c720fd8c0c6d243f882c51f08a539fae8ef2fd49fde9593adb802b7de44e7f6d8bc16a533e0c3a42a15fec1d7e674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
c906e33e92982802234945684bf0deaa

SHA1
53679b31e562c3e75d10f41f5023f4efe3107f2f

SHA256
a2931d257d01a4b64cfaec5f7f7e180ea22d64e72d23f0b9baef6bb623cf2fc3

SHA512
ddd2841d574222368ccb59203ef28d08e299583a192266fda0fbffbee87f6b9eaf442f584ccd9da4b9f1d512c03f1fa192cd389282209b3493e6bd0ce235553f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
3d3d247fbc381f1290ae0212933aeacb

SHA1
b5cd54b3d507aa502d60624b51e79cd036c984b3

SHA256
1d4ec9ae5d84e460b30fd94d722b81f996286e116c24ae565d1f6ba4c4665d85

SHA512
77bbf28994e9039a47a23ab0e8453a12b4ebd6abb58d34d3c405b91b358e6f2e0bf7f788fe68557b41ab49a83f81e4e576b68b4f6de3342de88ea226e89ea865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
0fdc3e0c40595529d7ae0e5f79abafbe

SHA1
c8a0bae5012b5fbfe8135c2cb199f8ead81f57b4

SHA256
f0adba41ca46a2cfb18c74f65a73df3453a50ff8597551775aafbac8d08d0a79

SHA512
4bdc595b3c7e1b88ce317dbc403a917c303bedc93178fa498cae7d08938c9f6084ff899a9ec8314d34d7e524d362bed7596a77c63a51f59678b01485be77ebba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
a945f3ba037b445e6ae91f770c057288

SHA1
f4be532be1a842f00a28179fc0ad53a11873eb56

SHA256
5c2180d0b80c23827575c04bfb09983ccda660a7b7e84045e224c0dab7d7d3cc

SHA512
668dec0926a997c61b4443dc955e74f60330d93bf9a5fa3d842216dfb41329636770108181f25a3b1b824ca3431f6cc0ad485247b91fd552eb960483e6b97d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e106fec48c6a2095db9ff0f8cc8d38d7

SHA1
551c4679e0d3dc5bfb3d1f58fb9c04e064237b8f

SHA256
c7ac7162349c9b1c7be67641a0bd87226411554e217f928f5511fb1305929d06

SHA512
5eb6151b5f1043ac0ec112d2993003b2c0ca1a337a9c51d7421f38ab0513cfa4f6f20d30d072371f54a329f128d74fd248b9c692a76162b6b83562912c46786c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ffad.TMP

Filesize
48B

MD5
705b30cc8a408db0fbb196982bf7cac6

SHA1
91f6c71e174ec899fd78ea042deb4b72742df7b1

SHA256
77f5dbed1645f85b5bf38539c77b67b9b3a578d535f759f586606e5bc5e4709d

SHA512
fee31b6e6be6e7ee4f99d5980678d2a5899f383d4d3cd6f04e550490b1b83c3e3b2a44ad82a5cdab5b789bc5d5c96081db0c63932ff9516751afaa664ea4303f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
282b6ffeb750c345b6fb83e714c3c4ea

SHA1
1fc6129decb38ee0de4bda44c63b1012c6c2f545

SHA256
8181bebfd5ccc8842bc84d213312bef9ba499f3427338208706c4592416fb74c

SHA512
fcc71660810c14d183c70a337564d3481eda3db2921c18cc73e7ad63b8959c426e897f93a9944d37611d00bf0e4e1264192ca6df8a0bf5773279095fbcdc2c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e53f.TMP

Filesize
1KB

MD5
71e9bc1d9ad6f73704b929019234bf00

SHA1
c7057e385bdea5329284a768a595926a38244cbe

SHA256
2dec96035d1efa9e8375e830e74a5ed13b3971169ccc38d9f62097302f683e11

SHA512
dd471ecd41616ad0b5fe86940cf86a064c6b9383e31f5b438fc618cc5c52453e715eda61e01fbd88e44378d2dcf0e0691391569852eb272426b6fe1dc3d22a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2e096ed57dd0cf362c1c67b6cbfb667e

SHA1
484de1165c05bf837dc4388acd3cc19ea69ebfdb

SHA256
d211cc736070cd783308ecdfe379c7e65522b8c4c5b787d8a5d3ab748c6772e7

SHA512
ef338d3debb2c1524f2046c645f8b76c6f593baebf9e2175816c55ccf86b942ef962cab17204b53e01960e678bf6fde5d438079c84bae57657d7e0cc4bc8b77b

Download Submit