hxxps://free-content[.]pro/s?ASPT

Analysis

max time kernel
81s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://free-content.pro/s?ASPT
Sample240608-rx8vssce4x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
2940	msedge.exe
2940	msedge.exe
3596	identity_helper.exe
3596	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2724	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2724	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1644	2940	msedge.exe	82
PID 2940 wrote to memory of 1644	2940	msedge.exe	82
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 540	2940	msedge.exe	83
PID 2940 wrote to memory of 764	2940	msedge.exe	85
PID 2940 wrote to memory of 764	2940	msedge.exe	85
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86
PID 2940 wrote to memory of 536	2940	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://free-content.pro/s?ASPT
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,18407125427960610654,2541238812100299299,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x4e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

91faac6b-7777-4538-ab67-e47c7aad5587.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91faac6b-7777-4538-ab67-e47c7aad5587.tmp
Size 1KB
SHA256 89896669a866b43a985a7cd557ebb1b9955cb3dc36c332951b083a181f1590a9
MD5 9ed4ed7c3382e7deb156ded4ba95623a
SHA1 72b2b769205f5afd52acc31ba2b69aea794350b0
SHA512 c9eccba78054481f6ed2e59c73cef17eba6cd12291baf04a28e2a2cfd6ef85c776c5eebd8e08ae496081eadc13a3cbcbfbfae6769e71a25aca569d6e37af80b4
MD5 SHA1 SHA512

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000080
Size 17KB
SHA256 c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2
MD5 950eca48e414acbe2c3b5d046dcb8521
SHA1 1731f264e979f18cdf08c405c7b7d32789a6fb59
SHA512 27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9
SSDEEP 384:US6UfnUmvJFi1g66OfYiMUvvvMnMxKV3uj3SaT3HA:bzfxiW8YpUvvvUdk3SaTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 14a35c577d12b623cf47776a067b122f91506e7738f2ea082ab002c746e074b5
MD5 538792f333a07e58ee044a8019b95cab
SHA1 8f4f3750c1c78da3522502805c8fdf336515dc5f
SHA512 a5e15590af938a0a7149c2060d93ccc266bbb4bd4e67a24faf01b31085e471992001586b99f1b4114b893cda7d77bd552672fd45de37de0ac11a0d395eac258b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 2305e76a9d69b0b6ae9b82982bf62d6a3dd41982ff428c5c90b7c629497e7220
MD5 d6977a771831137ea8f84328196d34b8
SHA1 525eb80ffa35ff906082b0f70b6c711b15a1977c
SHA512 ea0d7f2189766d408e96050e1787be93db6f71b58cc0d3180cbc6d3d92bfb15524327d1e16dae7f2396b3bcf99bc0ac7e8d80bcf3713aef41570e3bdfd359c32
SSDEEP 96:+NDH856/YUC2foMSMuZDQfFgs+ti+aoAX6GjgeSVMQGlGNYGd1i6UtxBN:+NDH856/YUC2gMSMuZDQfFKTaok6GjgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 eb36ad098b827dbd30702c47c6e0de7696371b43249eacbdc4a3be29b204b4b8
MD5 378df03b7e1eb3278fc697101bdf7f19
SHA1 b63f24583843117793555789c358804729b93309
SHA512 c726bb29b0c422be2c0c5be74223ecf5a561b981cdace45f38922086a51fa3e8064964cda81ee754ddadd7dad95ed61a75086577b8fddd98f0d55bd4c8335b10
SSDEEP 96:nkAAkYPgw13D9wpIUWMoiVmde8uR1jpRmqKUWQyV+VD7AiEwb:nkAAkYTVD9FUWMsuRhpdKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2a2820514cdf25c7896c01643e09ee98fef880fecdb22adb5f681eb02e445307
MD5 da53a59a2eae80dd4b28f1fc8056e668
SHA1 0d47b19b9a2757f7e01dec7e5943e43953e34378
SHA512 0d7f8656eb1bc5b48e6eb508ebd925dd202b2897bd522c9d7a7029915797363ab3ca7ea014563411c2d8b56dc5fec2d5cfe970d47f5a0d8148de2c1a3df44dd7
SSDEEP 96:nkAAk8gw1LD9wpvWMoiVmdeHpRQqKUWQyV+VDCziEwb:nkAAkS9D9GWMXpvKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 89cd496b1b3d853bd0d556ca0b166c6e9731e6bae0e742004c0e2bac18620fc9
MD5 bb8fe287efc1e76735fd86d297df6bde
SHA1 5487c23c82b228e4875792a32116cc4b2f60f269
SHA512 da575b081b8fbedee72b82778228e01c4a79dd2cd82c2b61355886ccff47a3e949e3cdd6f54d68256a4b8c8d8b96ec4f783b7e6f774f1eee29d2f14eccb49b77
SSDEEP 96:nkAAkdgw13D9wpIUWMoiMR5mdeqwQjzNddmHK2pRYqKUWQyV+VD7AiEwb:nkAAkdVD9FUWMMgwQlddQK2pjKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\d6d217af-3663-4fdf-982f-99f92a69046e\index-dir\the-real-index
Size 5KB
SHA256 b31378b87fb18c7abf861dfbc7c525529312474a57c72069c6103f0efbcdbe8c
MD5 1a3a20cd39989ab1bc352624c39a4122
SHA1 def84ff8291b4112e37dde7b5637b354ee3b1bd5
SHA512 f133b11182817e1009f4b6ac5e0b7f7b4461e3ec70dda2ef201f843adaabe4ab8b132977b899cd587b5d9e509b6effc4ad3a0626fbdd2e4e9bc262ae79c31201
SSDEEP 96:caeima3qyp2GtD1N0ywQ5k2ZRrXZMGI/Uji4q94kA+TnXbzgZwPZ4RDx+m:fLqt2h3wQ5jrp/I/R4q6/IXXgZUZ4RD3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe58271b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\d6d217af-3663-4fdf-982f-99f92a69046e\index-dir\the-real-index~RFe58271b.TMP
Size 48B
SHA256 cb393fd48613b6493149e540f5009932dd31e13b81a4f931f78b6e7a5879637c
MD5 17c0501c567ab18728a70019b97bc5db
SHA1 59ab1e9c4de01d58aee2b9f5b9e6c7eaa509b0c6
SHA512 6df88dda1725f4f72892a0ae2b566e1ada1495830a1f35a090d602501161ca07a54e30f4011e721061568a300be2028b740712eb64186fa696c73572abd69cd3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt
Size 89B
SHA256 87922d31125cc7cc40bab8a38bc4ebd33f13f8ba994cd8262221894490674ebd
MD5 d0533ee149d9dc1f30bdd6370e82066b
SHA1 4f5316a96aeb8c135f9a0d84d377b91ff012f3d0
SHA512 c8ccfc032d1fb897b6a2483993a4791c7a7597f3ad45781fef17523c1ff3567286b82f5554f124aad06b48e6ffd99d00ea42fb92e3a27791d660726a44cc4b40
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt
Size 93B
SHA256 8766357574b6e64006c4cbf9c9f1fea02a2fa55348f53025bedf773082dfe0a7
MD5 d106f1943c062582dc04a9efbe7dc89d
SHA1 c2ce9da77f82c736124344bc19608e40fb779054
SHA512 6c9652b542f789227adae55d7d892411aae1f18d7c5dc4c44de731a3999f44943e8d90fd228bb428bb665e54d54f069db978d787deba31b9d2dfd3283a124d30
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b53424edc2b2fbe3b989acb0ec8d08af0392a1e3511a9a6aa01d402365d95cd6
MD5 1b3e572160afc47f1e53508cee3c92f8
SHA1 89971185857472846059c2a3cac5982bdaef6667
SHA512 b7d0883c4e5d07b8126ed73f23b89e8cf4aa3b7b819df82648bcbdada15a134ced5e30bceadc20d86ae0ac1df8243b4a70b61ab55444daa662a088df810245ef
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57bedb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57bedb.TMP
Size 48B
SHA256 1d8c2b21f98df7ecf717e1f3d6fcd99050870f85f15107dfa5d460f0ce8988dd
MD5 ea0a6b5b108b89b0569b7747a07bdb09
SHA1 bb6555eced6cd0e020721349a7e46aa69e8aa2cf
SHA512 7ba6eec1d3c195298f23db33239fc677955bdaae9d50cf65e16245666f00e5647bf6ef990110ce65490c08794ca33c4a9c853e693fc2cbd355f855192d09118b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 09ad4055d15ad48193dcc569c394a18d9d9d0f69dc35d70ca9afb480a290febf
MD5 46042c21b776c98e37b33cee2f9d33aa
SHA1 2a66571038aecdd97f6c8c4f92d4ca01b265be77
SHA512 234dde5271604bcdc6286d25eb132c8807309f5f72500da469b4a7efee52523b3786fe9a5a255c43da650022458139006639d99cb9a7fd7214a349cc6b633eba
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7a5bb2140019cf70fc6879601de5fb1341a1278e8cfd85c4fd2b677b72212bbc
MD5 c0aa454736d9c85e7b8be8aa7665d595
SHA1 67a6bbaa22c864aaf50473ca9f04c0c469771911
SHA512 9927aca1102a8d8f5137778b3a0e6af3b0f7ad7d613725cd91b670277e8f87604bd64eb257823a2601f0f984cb8fd35629e002dde1c743abc9e1e376b7d40f26
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57857c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57857c.TMP
Size 539B
SHA256 976e19881d550d5ca49bf7143921de6efdbe96a290a6915584ea88477f4814be
MD5 297df6b8b91e8c922713369b341635a9
SHA1 e3be46cbab76deee3dcab2cd6d5d1f955c489a26
SHA512 7636b1341de57d406606580aca9d7f621feb6e8afb0f8320efed2b2a304ff7eb370ae8a51c736f3a8f7cee165a4a46acb9eb41baefc9cdad32f8700744aa454a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7dd0d62d59bfb7e32dbc661aee782d524420e87ebe0b5e18604098f710c9dc14
MD5 373326647d6e08fe280436662be2aa08
SHA1 52c83d3c068e66cad9844534fa7208562c3ee93f
SHA512 cc30b778f39fb555e15fa835e7378443457eb2ed955a6c39487ad788cc19403b918dbbfa0652c90d36b795493c875ecdf378729f215f13a8c20e18804f4147cc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3Be2RUaIT33z2OMDCRHqlq:A9iIxuERzA83h09RZxY3V63aOMWRHqlq
MD5 SHA1 SHA512 SSDEEP

Submit Download