7b0dc0ada5b2160db5e0a132f9e97b9f581257c8458330af2a5ac2de66eadb1f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91427787269fe2e7039b5dcedfe3706e_JaffaCakes118.html
Size 40KB
Sample240603-laqstabb85
SHA256 7b0dc0ada5b2160db5e0a132f9e97b9f581257c8458330af2a5ac2de66eadb1f
MD5 91427787269fe2e7039b5dcedfe3706e
SHA1 252c06f8503a766c1947908d5a8bd3e1cc8a42a6
SHA512 babbe52ea2ec022b5ecfd06286845b57bca125c5ee956a4807f91ae73b3cc659969717326c700a202affc24436bb18da524b674bb08135e71dad27231d7e64d6
SSDEEP 768:9pROQzeTVRP2BpBL0kTcskerrGZLDKp5ZCH1CNszfsrcwfCYj5RjrKZKcWa7Ulr4:nR36ApBzTcske2qfQY0Ug6x5AKctUlr4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2868	msedge.exe
2868	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3692	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3692	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2028	2868	msedge.exe	82
PID 2868 wrote to memory of 2028	2868	msedge.exe	82
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 4916	2868	msedge.exe	83
PID 2868 wrote to memory of 2956	2868	msedge.exe	84
PID 2868 wrote to memory of 2956	2868	msedge.exe	84
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85
PID 2868 wrote to memory of 3632	2868	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91427787269fe2e7039b5dcedfe3706e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc468746f8,0x7ffc46874708,0x7ffc46874718
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16180469509575024714,12258060203846556717,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x314
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 46KB
SHA256 2ae2564f74716a4e44850d845f0cca255c6c0c3a7dc0c8ee6bfca0212cc394ec
MD5 f871dd44ae8c9e11c5c85c961f8b2ab1
SHA1 7618910822a0f2639b405e3c0b13faff0431140a
SHA512 3b9638f705f83e37c3e0c9db1205b2ac76b96ba72ac56013a6aca6f34a7a9ff3548e8fc67d2b85c9f23f8337f696baa8fab01523fb04b5fd618b130501eed47c
SSDEEP 768:ORCMDx+sxzB3K91pTuAPhAhbh9ScwzB0fILVpV32YJEGtOnExKv+QTXyUjSL5p:UCMDbP691pamYSHScL2/YOEg2QTRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 23d800a0a87c9bf504be27f347e91086ff70a3884fe56379065524252881a695
MD5 26335a22098eb8bd829a42d56aff4b49
SHA1 6175e4d1c53b05f0d1fa73b0ec552a083eec2666
SHA512 e79589e6a431e740f9239715b86bd884a1572a3fcff4509a8a850c468d76b5844afddf879b1428dc03169fbd0655d94eead169d822f3722d393a7179936fd4fa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 a1a7b55bb38ed582ada0e1d26f0e7b2270a18be5c1732ef9ab0cfe8b4027d2bb
MD5 18c3e302c13bf4bc28c07f120933517e
SHA1 d543a792711a27316f25a367d65e4dbfe4314659
SHA512 d4676a665c29c98a805a7504fcaf6070c745f2f035cae2e01499c0a1651d74ec7e662a9cd082ad3cee9c69f21c32515107eccf668571d14982136a18bef88dce
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 fa078b074eb5df4ef9758a865538dbf3d95d4e5fa211730a6ecfcd8416e4b002
MD5 69e9df902313c30c64d263dcd2b237f0
SHA1 b3e0b81813e602133c7f7b4febc5a170dd9c3e47
SHA512 e19cb466410d906674e0842fd2a9fcba7f0888541611a4f597b0d9bf40af6a06ef956fb7de0568c5054ac79a2843afc657e00d98a45dfd48b291cfba9b6247bd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 907debe1cdc6f68aa8e6a5abead67072208fdc6a2c60a5e3b4dc5ec585ffe031
MD5 ed0b5b17a606628d65357f53ca80b200
SHA1 45dec1c6dce2403ea1e13b68ebff97c7afa11cb8
SHA512 68672cb30f082d7871ecc0b76cc7f1c3c943ed610c68b7da869b995cab5ec0a102078d5f0d2887adc10522e28ca9ac4f0489c1a64c829dd2e5f74a0236d3b4fb
SSDEEP 96:nMks01qT9wpvWMoiVmdeHpRQf0I+UWQyV+VDCziEwb:nMkhQT9GWMXpml+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0420c805dd3a8ed3218d1735b5707700e2d90e9b9aaec625240f1de4c0291e3a
MD5 27e57915074b75e329ed06711464247f
SHA1 18d1af9d00bee3740d515e383055b3a6f6408910
SHA512 b0c5223ce0ad07aa3e8868e8c1888c81af5ec922364834cc4583934396951c0dd8b8fb4e94f58b96b35b73d24a81de6f560e88f03a66e3f2795400a9bef33fc9
SSDEEP 96:nMkC01qT9wpdDoSWMoiVmdeNbjYHHf+2pRQf0I+UWQyV+VDkDyAiEwb:nMkXQT9Y5WMdbjYHHf+2pml+rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c2cca418f14fd46528ad52a099f58bd4d13f548ab2aeec9f3c5a7022b7ff3b9a
MD5 1037fabea6b10de528133b041ad9cc2f
SHA1 e60eaaec8d8a9ff7a9d50531316426a9807da86f
SHA512 352e9f456bd007a0bde65de28f2d3a6c39ce77bb1b8458bcf58c3dbc52d94fd8e37e6403e7035d626b2b05c8dc896e3228fd67d7eac7f2cb53fee090db94963d
SSDEEP 96:nMkX01qT9wpvWMoiVmdeNbHHf+2pRQf0I+UWQyV+VDCAiEwb:nMkEQT9GWMdbHHf+2pml+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2a4d6cf5-a77d-465a-a1c9-e215bf865451\index-dir\the-real-index
Size 624B
SHA256 270f220c63fa15efb8e94adcf02f2ae36782600ce147a35b3105c07df986bf62
MD5 da32e28c4ab3c8da8edf7c5924d796be
SHA1 f111286cca75a91496231db0ac2d994c3fec93ce
SHA512 59008e00347cb52069d3e89aa4ad6b428c01e264387fe95e85daed9b7322fe7f3c0627540ffda2b2c45cb6dca0844a77580bda53b4359fa296e8e6673cf6c7be
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57f9f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2a4d6cf5-a77d-465a-a1c9-e215bf865451\index-dir\the-real-index~RFe57f9f0.TMP
Size 48B
SHA256 6fa19f9787f37884f4b3dda214f85218b32a87de75e62fc14dd1deb304b8772e
MD5 aac0ebca75919bf65e30e770f6172309
SHA1 51d5c0a695ee9ccdfa4ade960ebd4d935065494c
SHA512 915ee1b37faf99e0852e323a3730ae19006354273792843cd72b4f8be6134ee76f40f556c88fe43ac33fd320dec541c162ab728e38f3902cccab4511d72c5605
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e4d3620-1c56-4f48-a832-3e39680c6386\index-dir\the-real-index
Size 2KB
SHA256 58c36143ebc888f992aefe9f33ef207c33e02bc2803d00dcd167a3a51118596f
MD5 fb30ffb9d29d3223f7bbf1b8d9407065
SHA1 a8ad4c17a2e2bb34dbccd5ea001a79bf47b342d7
SHA512 efff0dd4d2aa5f068474a4009aa564c5f1d9d63ca90d8ec9e7cad80086c8be570be032a58c173531fdae1e2f672cc0e239db6da271ce7590eec0554171045175
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57f5d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e4d3620-1c56-4f48-a832-3e39680c6386\index-dir\the-real-index~RFe57f5d9.TMP
Size 48B
SHA256 06a06341e153fa1f4482b7f4343f1565d71532a23ab5c1cf50ee9181a7298676
MD5 0d234975f3d05479ee57007d81cc35c5
SHA1 ca6a21c99ece7a9db025466a406a61330c4b9e12
SHA512 96fe9cce6f8f2228d60c14b97fa59ec2a7ff5f785e024925250f8d280ea951280b7048ea5d4211903937c213826d8db41fb8ff8272c548bee292d809a5794e7f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 7e865de3be4685cee6dcbf030d333b448ec91e469e6d031f6999f6bcd377665b
MD5 e959b2abbc30f3d6578cdbcd7fd81c26
SHA1 9b318ea79bb35c5cbed817dbe693d2d2cb3813d7
SHA512 04ce3fc22a1e8ce7c9ed08c6509af4ff1b85914c1008e1a1e605938b281b0963662c8216c3bff4fd173a49a7023974825c96fbf77be4706412dec6fd4a713f15
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 155B
SHA256 dcde7e73ed1982b98c125ca57a7677bbd9198c1885718685b805ceebb20d50f3
MD5 e7354f41ddd0d58af4fd1f3463940ec9
SHA1 946502a418801ae845aa67082fae597ab290fbf1
SHA512 4abad2b24456aeea08b53e5c92116cf9b50894e6bbe9b770a369089d3e6849ce703b8d451b693f43efe1cc26afa66b0b3ba8c13b04a383d5d955ed368ecd258e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 970de1fbaa65d65f2da67d10d0eb924b10053efa11e4bd3c65e75bbdb69b59a2
MD5 091183cabb05373af26e06c125478197
SHA1 01b1cc830ad92cffb5c3f51120d5a5ac8415fb3f
SHA512 e09cdc71626fdb0535ea9e6326ae801140d8645ebb3b855a763e4f4d7a0069533ac222600cd9e3467a121e0853235650e377414441017e133efe27812c9fa4dd
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 153B
SHA256 d85b554e836e35dc8dc0df2409aa073790b437196acdd43f8e518ae8f35e9113
MD5 df38110786f9ed3f11a4acedad4e07ac
SHA1 0ef0defca065c51ed226b23adda3d12d967bee85
SHA512 4134be049dc5cb196bd56046b7e5dbd682930fd8d0f14682a6470646a2358fc0dddbe7acd1dccc1dbb396fbcf0510ab3b93796484ac39ed7b5696634fcb8edae
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57a18f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57a18f.TMP
Size 89B
SHA256 0a2f6b1e132d7c670404aa824e2efe5c2a0db0b3418dc6cf3c56d222bd94a683
MD5 6cae749dd081278b61b5757b8d7c506f
SHA1 0b5c9d2c91e3527c2c7f3c6959d4269dbe9c67a4
SHA512 149d3e753cbb9168115be4523c24ee937013f1f16be6dcf38b4885dcb031bdfd19d64521892caf10367795b29648a08fd4b981f6d5cc17bdee849f479858945c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ab5a79d26ff4ab33f307b5536fad7d3f20f5169337fa2a467a4651bdeb17c3b7
MD5 c87d26b796b6c7a2c7f6139dfc76d288
SHA1 8c3c8a57d87a53c74bb32276739371c6b8fb1162
SHA512 a4cf27c6c20736c118fdc541a85a103c797a5a5c4a608a3ce80e3d50397c70f95ea2663dac6992e3e9fb0f01e28f6973a695fde89527a3aa25f030f68e94d119
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57f117.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f117.TMP
Size 48B
SHA256 9000503d97212602434d4beb7f22e49530fe0a09888299f695c2184e182054db
MD5 f841643550fd45baabaf449158c6a9c6
SHA1 ba14b2ae6778495c1849d4414b505535109e3a48
SHA512 41231d44412f0e07c0931daa46c40fd0f0db5e632e4d5f3d458e2f03743c1d8d224c74f50fcc73740b66d1703a924405278d7c1b203d9716c9c33bf33fef7f06
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 641e1cfe868e78c5cf926c48b3440af68028e68e0d24b9bc15a7972f62b1e99a
MD5 8b0b4cf8c1c788120be3362d1b2bd304
SHA1 ad3842b8f59228949606f2b9f9e49bb02bf5c080
SHA512 4f3b83eebd6dfde85d528e8e0a5f545e2c3e05a077330de299dc437e8bbd515df0b1746cb9194780b62c653e42acf650664f331d1e55f86fe0cda68d2bdef123
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRXYe2RUo19qTL3z2OMDCRC:A9iIxuERzA83h09RZxYRXWTgLaOMWRHi
MD5 SHA1 SHA512 SSDEEP

Submit Download