hxxps://youtu[.]be/80j4SL_GZaU?si=-WD6NVILmJzdm5gL

Resubmissions

21/09/2024, 01:33

240921-bywnvsygqr 3

20/09/2024, 22:42

240920-2mwslasckf 3

20/09/2024, 22:42

240920-2mmjxsscjd 3

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youtu.be/80j4SL_GZaU?si=-WD6NVILmJzdm5gL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
3636	msedge.exe
3636	msedge.exe
2880	identity_helper.exe
2880	identity_helper.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3408	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4724	3636	msedge.exe	83
PID 3636 wrote to memory of 4724	3636	msedge.exe	83
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 1320	3636	msedge.exe	84
PID 3636 wrote to memory of 2412	3636	msedge.exe	85
PID 3636 wrote to memory of 2412	3636	msedge.exe	85
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86
PID 3636 wrote to memory of 2884	3636	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/80j4SL_GZaU?si=-WD6NVILmJzdm5gL
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9684846f8,0x7ff968484708,0x7ff968484718
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4124774837510731084,209642763182089263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ed29937d08281a1178a1d76c4928df33

SHA1
10859fa8a96006cc88484d18789c9d06cb1aca9d

SHA256
d5e4d43cd3d7f042f40d552db8d11d036a1a180a59e6b388e055b59768c8e53d

SHA512
804409adef89983a0111197dfc4c1213a0ad710a1fd89bde25c0da0d6b433d7f885b0540c7c65a8422bbdbd8d568049a5ec8e18a59d251b20efdedcf3f45dd2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6aabd4801a70c5dac3b4e31a22bdf1d3

SHA1
bb68579cb1c479be11b48a7c8875d73b8a00d67b

SHA256
ba1d7a5861fcd977399ece5633a2b4fa67fd68b4da6ee8a241752ec25fd61b13

SHA512
88815a8e12a61420d1a92503de4bf73eb78b3aff1c760a50bb59348a6aca53e1276205e6000f6e1ac37d86ba51d0cb49924fd78365c3ef31479b7e73c0a8c3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f3c56e46f68cae2a8a311559a7a2c14e

SHA1
e7a303f384183056ef9541dadcb06de071bfabd1

SHA256
748957659bbac98c03bcf6fcb4ba398122ab4db58e51fb8057f99ae043c4d93b

SHA512
898b31cf670886ec4d47fc0c9b2407ffd8065fab55d0d1bfd243d7eb4e71eba97ba0fe3fa0ae6563ea5fe1517f6e78feb4a5ec2395aaae3fc32b74ba08bdda6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e60d7599722ea2dc2a701aa75dad32c

SHA1
9823a7444aa957f4a0275e191b80c092b6df0e64

SHA256
c02310a5e846f0648c4e0e44ab655c58784cdebac62f0db16e286dad4d1a7f74

SHA512
6f8698bd78c14e5deb0bc64431e3c03f41c195afb43c87e517927990a5ebceaf7e3a52e86a61e980e6ee41b240a410233ea11eb11f44d0a3aec5313848718bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d38a2ba2-69ba-483c-b1cb-df0a072d4063\index-dir\the-real-index

Filesize
2KB

MD5
56ea6991e771e67f88bb641d119e9363

SHA1
ad0b5229e12d94bfc44bb9566fde016e1eef36f3

SHA256
20eca1983c30a3b26b1780ea8c82a62702eeb841af446bf6d963e39d073ca3f8

SHA512
feb697608b38c622f78d5ffd86c5946f2cdabba9d87e58b42adfbce5e31226a4a0ce63d3e6381148625b16635389cb8d627fdb44885b6813a64401aba0c1e579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d38a2ba2-69ba-483c-b1cb-df0a072d4063\index-dir\the-real-index~RFe57f453.TMP

Filesize
48B

MD5
a8c82273d02ccb5aa647b50f8fea6eaf

SHA1
be300df5c9d4d40a917757acaa6365ddf3ccab82

SHA256
aca1e10ab740dce63c115c87a3774d9620c72cb90b3fa1ebfb1ccd071c7a1fff

SHA512
9bdb20f042701ba6cf7a2a5ee0f9fd50e915b0b47c1a04b3a280c78cb00059b550c92762dde5275126207da1394fd21449fe37f80d0d8224c5698e1f04fe4d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
00f3bc84778e49e83751c6c4adbde11f

SHA1
5c93043757eb5fb3bc56682013afb096e5e00a6e

SHA256
e2bfbef5015beb6c88fb9c75a6ed5ac78126533f8008aa69a716bb08db7702d3

SHA512
dd4265988d4452f024d4a0c13f22be03847068f4b4e5723ac0e5e4e7aae2389da2012e035995df71e72236c338f6339fac61f669a5f0bcdf97db0cfda549a855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
5dc3e67d4f6204a64b5dd2ef161e7b12

SHA1
e73d296c5f26f5489290aa5fd587c16401f3fc85

SHA256
e013c20a3d3cb6d88b904468be54bdaa1bb36511228c9c063c90cb5d2edd8833

SHA512
d8db2fd5b6f8e452133f8c31bcd54799fda475edf0f56d92498f3e8ee2f511c7d8dd478c0e9fe3c48b02f016d2cd5144b3dfcec271b3761b603d368d0f776e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
914d4e2918c89e6f9655d729399c1293

SHA1
be3c2ab581b12c923d108e5f210ebeb7942d1926

SHA256
705d460d4f551d79f73733079d3e86341c3d12dbb073dc4b555a7b2c6ba0c1ce

SHA512
b98b850b7cbb93175714f10288eefa856fd4a164f1d84a305c10fd1657674ffd5f0d502f8f0acaf2ac728d620fce55bd4fc3d6a55bac551c807d74b9f750ce3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe579a4c.TMP

Filesize
89B

MD5
569a2add8db71e381d7c1c0f07b3159b

SHA1
2451f5d44c0651be2c848c4e32dc08d2b6d1a872

SHA256
19c7157cadf91406ccea4c0d0e4cdb429be14b0a2c4691494eccfdf539c8fc97

SHA512
ac26cfb6347fccb79bb045ee6a1c719a11196175b08e80ebec12dd4ee99715980e38a1de7eded9b67d4fe9374336eecd5c5337950f42c22cd18ecfec20b0cce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0189f90fc87a4ea335844bae48cd0d9d

SHA1
d92930b0d10234b61e9d6be4ba0cb9d4ce59e366

SHA256
1804fba4bb81cdfe016d74bfc1bb0658faa1818cb0dc337d78f154c2c84f3831

SHA512
4ad307376292fb8c1c993ef645a78ad1f13d6b567cd74d05ae87e00bd7014fced5b6f1a09b91ca261cfa845de1fe82f9bd39926ee7d7b0320e85cadb1b7f1ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e956.TMP

Filesize
48B

MD5
2cda1bc8dadc4b0ff669cf555352bb33

SHA1
50fba97a17355f22665e03da6cbfe6da7dbfd0b0

SHA256
dac4c4bdc5991556bc0f215690e07e0c3bcf3891aa6a58d3834f16dacbe479da

SHA512
0def59e462ad9d9251228f1af714e58996b24e061fd4671db65747fbc4f4f998bea3ce63fabf0c86446d5802317cf44b792f67c215c9bc701fadb0151affe8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6d88b16f0afd38aa13a8190fc65f30fc

SHA1
1dbecda857168e0247bf3758444f83f8b65513e2

SHA256
aeaa1f06a54a4014d0703ce7c2667d299906805217f0bffc8774cacf202830d9

SHA512
06cc3b37e5f83b856f957523629c62856a4564940ffee0408487d9d197d3c48c1be7aa1700c6e27846bb1a8482e247c13b3469c4dd567507f6f5efe5993877a3

Download Submit