hxxp://youtube[.]com

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
920	msedge.exe
920	msedge.exe
1296	identity_helper.exe
1296	identity_helper.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5040	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 2472	920	msedge.exe	84
PID 920 wrote to memory of 2472	920	msedge.exe	84
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2892	920	msedge.exe	85
PID 920 wrote to memory of 2556	920	msedge.exe	86
PID 920 wrote to memory of 2556	920	msedge.exe	86
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87
PID 920 wrote to memory of 5116	920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8297146f8,0x7ff829714708,0x7ff829714718
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5417939194700579284,11752492506050956243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
232KB

MD5
8a3004a6d32a32dbc11d59d4a859da54

SHA1
b5aa6f7d77a6420e8c85a2377a4674f6bb7ebba5

SHA256
3a6ed4947a4611f0591f2924b710cdad78d39f5552e8552c21c72fca95665929

SHA512
32e23895d8a48ce1ffd16a83a6d30721b9c939677b5e47bfb15f37e6d1f0795dd34f1a41c73b8b52f53bb5efe8266471f5aebaf601175606fb48a1fcda9f29ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
93KB

MD5
679ae6828307d99fdd8df7ad32a45727

SHA1
13e4ae594eb866713bcbc91295976fd387a3b144

SHA256
5ef5ea70e430011c6df37ae561cd1e299b43eed8e5e17640bc9110af178baf2c

SHA512
cc8216ae2b7e4f58ef762f33839ab2f616fe5d4e7076a9c83239e61c29a2852732a56a1bd6d58470f9a2fa5dc473654f181ae3882b40d9007043887a219f9ded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
3684c7775bc328aedb86315ec6891439

SHA1
cfbff177f45afdf36026595ba0abd3bb59f86a43

SHA256
e8d182897c2ec12664cd8e86b31ed441f775479b41a7f1ba39278d32e29fed87

SHA512
2f5f00b2018c4632260b7b26ed4d524dcdcc02f66c3e561a3ccef3a023c042ffefc3028329b4c58b59c4186936d51514b892bed0da00a410502b81bc95b6230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
47KB

MD5
d68e16f4b1c4ac2ba25a3832816a9a73

SHA1
483d682342aea24ed78443e09a4f9e1e4e7bee3a

SHA256
7a3b1646e73713640dabfc22a14a07dc2f0e3eedce783f1312552286104fed77

SHA512
67810d66daec6198445c431bf0b7eb1b78e8a3f92fd303ce342e6d7efe59c061283dbf7d7281fbc11416097022d365698b1f0cbef22672d09d0bc736a3535e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
605KB

MD5
4dee9994f5847adf284d8727c6109b61

SHA1
b6a2cec46baf82da9c8ac7c8ffec6f75dfdb7e7c

SHA256
e81ca154c634f1d8e56580995718ec7c34fc4b45b61c36805ea347040d124e64

SHA512
96b56c04b315927ebf5c0d780ca6d94ec0a8e8544cf9c01f74540e22e9ede882b00c2d73de6b04c6c2ee7233524688c8fa19c3caccc9a55d8073aaf110607fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
33KB

MD5
28f28f9ab8d8a15c7b15246b77b413b1

SHA1
74a0bd96dbfb39c19f1ef6399f1a6adc1de5de20

SHA256
04f73e0d2c136265f4c9b50f2e619414c156ead2a5181ce84739922b6c9fad4d

SHA512
d63b7474ebb3a6629c4e20407c0c379e194cb71d12f1047219c072bb2450308fc7447efa450968cfc520e6acb456bfedb8b83162e9367efdbcf49787cfb1d466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
32KB

MD5
673269c477f35966b5031f665816d043

SHA1
d082b1a27742e92a108112c2473a43e73cf5618f

SHA256
42008d6a28b6ea01964980c7691aebb91b93cbb5f8ae8b2668c94d1483a225ad

SHA512
423c2dccf173a1a193138f776befda7b708f5fbd0b4fd09bd278954fcd87d2510d73ec6f5bd0a3133e9e8f946c256ed26040125694c1db6d7d57cb4cae5af4ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
93bccdfd4eede61d677494deb45b39cc

SHA1
aa66ec6b1c75ba692ac30636805bf3efa2127e89

SHA256
b67224f0d420ff1905ca8f9328fa000e03fc512ffac2832f0a9aacd778970eb4

SHA512
3d62d3e333093ea727f9350dc6b5a66f44b773fe2140fc57ce029f3354995cd0b592b9f180e2ba9759baa760d78d12c0c551b1bd332dfa825b4c9ede67daa2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
914827abd5a5920a0dcea34c1d7237e8

SHA1
fe7c10d1e03f31db74f9bb1059e2546a4fd4e31a

SHA256
e20b5b156529ee62ea0526ec549430c0c4b7b2276556cb9841031fa7d74d926f

SHA512
e43d0b9f7ecc1ab2b32b6918992dfc6932b604dc57ef195ff4530e598f657e12c4f0f81d04ebdcfa0382c9ecb00799a0c5348e2030b3eab6b8bcfa6d772e4093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0a1667956c600a0ca4ee26dc2304f6cb

SHA1
414473f645368e54607c52c0267dd274d8dd20ef

SHA256
9073223dac6f7bbef2af80e2e5f63f9af5704e919bc82fcb440e786c71a607e8

SHA512
2eb1d95a98daae85bb1c9f3d702e0fefead4d6c7a381c1b903270928ce5fbd72853ae68139d5217f421294e199526716b3eb789b38b326895989e248fefd1d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2499aac9926434d927a5c4c040a3f07b

SHA1
6159a8814204cde34361775c2b818f24cded12fb

SHA256
7dcee437c0adcad17b6a25fe061307486e93b1e847b4136787db2f38f3072947

SHA512
e49197eb36d03fad254a12c9ddaa7faa4a215d9f59066cdd2cb844f854bd74f3b5b193b8db19a7f56cb0fcdc9c020e01f7a76ee2e60c9328ffa0c24e4a2b9c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d7f85f5688b8e149fb99069683b225c

SHA1
99d8f956039a0d0d80f46be786f96f70010e7c95

SHA256
838db31d63632fe07f5a03955fbef9be378266e5efb8a7ea835aa8b29bc16310

SHA512
8ad47c8e30ceb0a20cf87d51571708359c57ec794cfc107e3f1a4f654b8e392ff653c834c1243eb0bbed49f050c24a260fb83a1b7a05806e6faa798eafa92e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce3cd663825382013999589909b53db8

SHA1
3553a9b5dfa22ca94437365dd88ea9922513c8c1

SHA256
212506001c6f506a6762d3ef61101bcc0d1615390721bb1e00ed7edf72c8a15f

SHA512
c1e9eb0bfe13c00218d62e30385de4ede1cdcb9a41dcc722633d944a11db0630df3bbee0773dc152bdc3ec986b3418e2950b0f9df80f316721ac06c8fa460acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3fdc09d6dca2ce4b2b214694d879268

SHA1
805207094d5ded00d730f383db2a7cd6ab06638f

SHA256
1a821456c05628ca0ef1c3d1e23c318d9e9d8107b27ec41f377a5fb7870f7f8e

SHA512
29fb12a90e7a180152437b29ca2f77d13c4d9ff258fda92886956661eff104c797776a354d65c9958c3d7a7605f85c5c06af7e61e614841bb35d73563a30cb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85731bcc-88fa-4abf-a886-aac7bc85e558\ba2381d73f63a341_0

Filesize
2KB

MD5
805237a2ddeb455fb3a4b2d882f3a2e6

SHA1
2895f9feb89d4a56d5978b105185773625554d1c

SHA256
7784bc467b6db8c4c18905a001bc3269590d305a6aeb985791766d18695cdd76

SHA512
d8ae969748ad61725e036a3ec78ac0eb664d5d7419617a3469568706d30ad43e6868ed6b8f36d4e13c9c294a7c274cbdf94e533f3421a29db51fd9ba513ff566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85731bcc-88fa-4abf-a886-aac7bc85e558\index-dir\the-real-index

Filesize
624B

MD5
82ea639ad92faf09e075ebffbe07e48d

SHA1
b211fb3aedf02e520a9604244e720e32677fb779

SHA256
3f7c8a757895b99ce5227dd03ed31cdfef9ac21e478cfd326fffef7ca4a3f35f

SHA512
fc81a8c09a0a2e436666efa3841440a19eb2bfa64c407e0782fd8e6ae96cd28dd5d42de6724787ff53de103ee8fa359196862bf80249a44029d6d616d2982c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85731bcc-88fa-4abf-a886-aac7bc85e558\index-dir\the-real-index~RFe58344a.TMP

Filesize
48B

MD5
1cb1a5e4b1e82c7f65ca2890c248940e

SHA1
7dfc986c0e13282213338100d7b135daab26b18e

SHA256
2c4d6dfdb203e74587cc2ce5bf37123a2619eb4b026318a7f24276a1c4cf82a0

SHA512
3c898066f435baf2c9588945f2cf895ac783dc05b3634c2e6697de4f01bc6a0ef0ba911ca974af2d640d623883719021a9b388b0a67e6c6d5b396d8e3c69c5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c76bd1d5-c9d4-4e5a-ae38-67e2d437a761\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ed1229f2-6576-49d7-8c89-d352784ad234\index-dir\the-real-index

Filesize
2KB

MD5
66cc11b3f1f627164c61dcb11869b6f6

SHA1
eb352b573232e3ea75116a6e3ede5a3ed3bc847f

SHA256
613eb74a47992750abb6f02d13f12fabe98424d4c402b48b8dbde9b9cb0cb316

SHA512
aeff558b4ff41c2ff22df57df24dbbf820cb9dbe7299cf9aca9c6019196c94f7ade240d719dbc779490e4e188f956a84555aba2a5ba61e6d76927a0a66d8c204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ed1229f2-6576-49d7-8c89-d352784ad234\index-dir\the-real-index

Filesize
2KB

MD5
1a5f237536b8b31f7aa23b2048d1525a

SHA1
8dcb9451a0eb4e61df058ec54dc3e8cd74b3bbd0

SHA256
f2ba309b51f2b72e7c6ec171e884f535e9a96642f2f031c34c022261754c9dfe

SHA512
865061c502496a7325cb9108c54f211a646ec4c62669513a4c6e50954163ba12365ecc7ec7ed965c9480f213f0eba2896155246eb97a5590daddd4f12e2592f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ed1229f2-6576-49d7-8c89-d352784ad234\index-dir\the-real-index~RFe57d8db.TMP

Filesize
48B

MD5
cb8a454892d00524adffea1f277f2066

SHA1
e1c3a852f5f3c57edd97103e66c55249b347b135

SHA256
56bfa101124e2f92e043b9d03d231dfd60df8857806e5f14e468e2993bf70bc6

SHA512
dd08088e824199d631c94e4e39c073ecb87a6c6a8926860178bf39e79acd91b2d9aa8645c517b36331efecd89a68487f2c2b6fa156edae4d5e98efba911a24a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
f8ee18095fbe2848611652cb7c12e116

SHA1
26ece87832c04d62b7b5b054b7655d29afd594fd

SHA256
d537d30622f3c318e1c046f75f030089e176fb20dde481b99236535c93ef7a6d

SHA512
83ea9b694f5c61ef242a98771f81b7fb41148826cdfb5397054f7de00d153c8f834cd94e21f145f529cc14a634922f789c50110a426523e3bb03ab1e9e4d7a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
c5d316e9b1ca4d7a10501d2480653b48

SHA1
d3e5e565c90eb70a5be0aceccb5f125883034c40

SHA256
d5df678fed6efcdd081e6420c143bf110cb61b2dc5c96e9a043caf75bc3c1c02

SHA512
1af7456b6a3a97969881adf9f2648f8da4348ca68d68d2a60bff1801cd79bd8c93860d6fe240f43c8601fbb144db9e0791f1ae3534ec314e0c6932fcb93e9e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
4efb53c70996faffd4051b784d729d8d

SHA1
da4859b9210dabccc14b450f50e8bbbffb91bc40

SHA256
4ae5ed3f399fde0e942d89677815944022c67c49b89d18fbfadc1b919af3a849

SHA512
307baeab1be8ae8fdbd47f717dc28a1fd8de86d4debefb84086a79bc5d53449614f54cea0be720bed52d4f1fbcdc6511359749d50ad922096ae5b4889de688c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
cb698e4bec8d56e587dfc8486e2b5b8c

SHA1
6e2722716e872f46d3a502b26cc24904afb03026

SHA256
5722e8375e04b803689b5f0e9c921bdb9a7b5d316fb50b635c19aec0eddc1e34

SHA512
9b7eb8d9f9f9350b08894c2f3d510eb9cd380d1c66e2808e000c585fa492c6398e0835e5e15d244b6bf0c8ca5119efce371f399b5b3abd9d23f4510555fc1037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
6e55e92b7ea6accfd89687405dcdae80

SHA1
ba5ebd95b8a094ad776787c48d2069ac21540c91

SHA256
f38f29354763d716d2261510828ae270c87e362d10bbe9c3075b73d12f298e55

SHA512
b4a8fe3d6331408142dcc3e0593f2aa40166510409b8318d66888721d4c9b6f59714c0fe929b36ca4f782a89f18c7733606df0cb5ad03387c13002268e1b0290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
63011501257c575fd17dda97c74e7b44

SHA1
a861dd09b51ffe4d27faae08c7d16ff0b1353009

SHA256
61d2aaca3279ce846fc65e809f7f6eb201640535a42cd1b1965a831c35ba4f0e

SHA512
2fbaf65c20d5d8ceb256070a4a4647847a7c91c8f4b5415060820cac51c84d0e8e560e1b3cff09659f94c53d04554bf3c192a48cac9d49ed711b556b6bca96b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
791897a10977a2badb7fc93ba4c59f5b

SHA1
994f1f15643116357c524f97f88247a53e60da51

SHA256
921e672f82b1dc26a22a6d9a041803d2bac9a5222f5a5d3f36cc8c0644ee1d62

SHA512
8b2bbc9374fbb7b79594f53ff77c87319de345350cb85a1809a7c66021b34aa43f49a5f2707084e8d0802836862d761ad0558a9ea83e23f05cfbd9e1c5eec675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
4cae69c8c417bf1b0c4d623a3ba6eda4

SHA1
f8f82689075da1999d2d427ed67a413902941236

SHA256
2a029294731bcc68ce969b8010ab25410bd5cef85c6b75b9a3c40efb1ab0c1c0

SHA512
bd5aeed5b55ae9573839ceb44b8aabfb8042572b68d98ff97a334e264affd969dd0c123f85f4cb4d906cafe6334d4fd69670e2c651a785011bca734789eee472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582c89.TMP

Filesize
48B

MD5
8add6e050ca373cc9d76b39c3ce7a945

SHA1
88202c20511d6f16b2584d172152043c1a3f4e2b

SHA256
a1c3f006648b1fd07b4c9ccdd6f50bac74efd5ab631bb8f69c8cb47d450386e0

SHA512
31377cda2d68aaa319292d46eb57b25f1eaef5f56a3c49977aa0c92eec2b2b1cffa4d9375f48e8b625a92e67c8ec93f6a3675eaa054111f6f700fc8673b55ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
88f56dca2712bc21d06e4cfa8beacf22

SHA1
c6feb2f8fe393895470c10e2a8e189cf3ed74b2a

SHA256
46ec3ea278350968719a1a661bd1f8d8f08cd618a3ebe097091d0e464c44e233

SHA512
9c5dc10724b0d524dd89eb47c64c2298a05e88fe352bf175926c27888433432e22e4ac5a0b54a9e7dcb7807fac4f8df89798a5f1c29646c511c507bfb8c1538d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d97.TMP

Filesize
702B

MD5
fbc44c80e3d74f528fce3268f1935bc5

SHA1
c0c1961d76860e4690f333c8374f48c8a2a81583

SHA256
fc76cb3fdf3b994ae6aa41efe48a14b5af521108dc0ee248c02f54bbc21a05cf

SHA512
7af04612a8d7b9d72cf97bfda48ea425dc70612b214296bc41e3972157f9ccfeef504a215bc3ddf325e38dccd21a6891d5f3404a8bae51412d6ea7433f6a2d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
69205a7fed7bbb5c45c7ea288e53d02a

SHA1
dc07911d75a36ab95aa6d5c2c793abc3d0525ee0

SHA256
acfc0a2bc9d4d8c3c184a4724d4061dbe3f7f6eb82342878cd956f0f0f59e6f8

SHA512
ee603ede4a6ae2c4758d6db8dd217c2193d46b43b2dcbce80905d8024a3da25886099f7842e1bb20c509ec1c8a97cb914942430d18bce4fbb6bb4dbe56aed8c7

Download Submit