62ec9dbbffc8577d9150719994e86c4a00a9b534b8d124c645d51f8d3a9b632e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

377e2d6c76d38fcfd7dfcfaf84192c96_JaffaCakes118.exe
Size

46KB
MD5

377e2d6c76d38fcfd7dfcfaf84192c96
SHA1

efbb5344fbbc411f0e9e76d6b7f4a2b1556cc677
SHA256

62ec9dbbffc8577d9150719994e86c4a00a9b534b8d124c645d51f8d3a9b632e
SHA512

8080e6a4125abaa605e5dd98d113bb882acc929e0cc47330bca80ed2bc0b4ce916daa83ddcb6f41c075707859f8ca76724b026a6ed00bb2853792e4a32e86cdc
SSDEEP

768:yhC9q/QLsw2niHC8Q9A76i6rOe9DLg9bGeSAkbykg4SOrqt7jp67huJdfAv8x:/9q/QLINv9A7p2SWbXvAhjcuDfAEx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1492	msedge.exe
1492	msedge.exe
1968	identity_helper.exe
1968	identity_helper.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3236	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3236	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1492	4088	377e2d6c76d38fcfd7dfcfaf84192c96_JaffaCakes118.exe	86
PID 4088 wrote to memory of 1492	4088	377e2d6c76d38fcfd7dfcfaf84192c96_JaffaCakes118.exe	86
PID 1492 wrote to memory of 2932	1492	msedge.exe	87
PID 1492 wrote to memory of 2932	1492	msedge.exe	87
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 2060	1492	msedge.exe	88
PID 1492 wrote to memory of 1504	1492	msedge.exe	89
PID 1492 wrote to memory of 1504	1492	msedge.exe	89
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90
PID 1492 wrote to memory of 1876	1492	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\377e2d6c76d38fcfd7dfcfaf84192c96_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\377e2d6c76d38fcfd7dfcfaf84192c96_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfb8046f8,0x7ffdfb804708,0x7ffdfb804718
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4132 /prefetch:8
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11017599007322576277,16315980160260184631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
89e03066fc61bb714af591ef5db36e7b

SHA1
0c190b0d0a4dc44a193447d345fc3a76c9814713

SHA256
a6b9cc4a7d0eddb4fb8c55ffddeb10abf6d06baeaafd745c140d83ed4ea24db1

SHA512
ed73ca51ad11ecb97288c5a4689e6a7b3b4210ada84b1d893295c4bd01e322165b7aa4ac0731b61a4d250275c525150ae4f552491aa5587a39965c0f797ca17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0f86b51b2b819693f6bbb35137953172

SHA1
67ef353751ee2cff417b2c21a7e615ee601903bc

SHA256
8a8d59462a08fde88fda7900a346cfaf993840e7a08c1177bf0cf077cc48c7a4

SHA512
4f1aacfc3a95ab0a0fae86f3233257b2234fbf160fc514c48a8b71568668a40600ca52f1b268d99634aabdbb695a74912699f5bc966e6702307b0a7469d6ef74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
eeeed585aa151bd7271e03432f7d0624

SHA1
0d176cbc3cf629dda298f98fe39bc72ed3aa5642

SHA256
9dfd2b1bad13a65a75cf76b98a2fa69bb89b6ae4e780cfee4f836f2ef175df87

SHA512
2b8c12afcfd189fc629b144ae9b91863a73a8e5be413398541f8820461f6dd6b519f70c9c4d4e7fca3ebfc3b563bb6e29f3e34d7c27f13d458e6a861891abbed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03a82beca6ba2ffa8807deb57ab358d5

SHA1
938e9a331db77b806389e05606bba9542da8bfb2

SHA256
f83f6fcdbbe46b986539118f303d27649149569aa17bb36c0a3ff0fef832b897

SHA512
3fa9bad1c4ef2cb98fae6c06d82f3faea808c58f5dab0b165607ef3a37800bd594b242ecd5abf63a2ecf9a8645e254ce901c54200e870b27b57a72ab47c74eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e317322dc67e244cdefcd505bd5e5106

SHA1
7f88c7a9dee67cf95e675ddcd6ded66fb0f97edf

SHA256
c5fab7bf0f80abdf5e1dc8eb2e90bafbc9753f5f5bc8e4e859b0a7a27f840f68

SHA512
6d4e9371a34389164caac63017d89526ff0be2c0e5abd0fee54e197ee284728bd4d2f201b5d27480898aa783ef1ad5e8e4f4518764c963982b87e826888a5d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\457c9b70-7957-4666-a950-a11b3534f1a9\index-dir\the-real-index

Filesize
2KB

MD5
c2572324a734a7a9144c0274fc54f74f

SHA1
0d7d6614c886485333a9e495356fe723dafc895c

SHA256
00c0d5afd823e4a162314a1fc2ff53a27b0a536efd6f9b8dd47bb5ba4f7fcf6b

SHA512
3f992d313ca29f174d2cb437861fe799ded2c82e2940290a785e959617f308a6893fe0ddd4ded51ae9aebe096a0a331f65eae64f2ced8bd2c6fbcd6a911026a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\457c9b70-7957-4666-a950-a11b3534f1a9\index-dir\the-real-index~RFe57fa7d.TMP

Filesize
48B

MD5
1dfa28ff2bf56e2a7a655e86164c0f2a

SHA1
5b22dd0addf48c002fc77ab16ec01503e3b721d7

SHA256
0111c15cb3df69c5145eda072d7182cf7dd64a1682cd7b49695797dbbeba7671

SHA512
65a22c91f3efb5598c0e222cc2ba6d3a52ce1533d995ea8ee79083443644f0bc68654386d0cd831483fbe76da3afd319414655f6ba60a69d192e3f998ae555dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
15fcb19835d3755b74d554387237c780

SHA1
dd3f3a97be78237c7141893d0c59693554079633

SHA256
906c575487e432957470b30829030e083a7a411c484105ed2fa09f3b05b0b055

SHA512
05340f460d142cb1a5d11c5c9556ca38e86ec14f23e7deb80bad11c49c3db2f889b242604714e90347117a826af370d40ab067c54c1192cd6986d55378559b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
a245bed4eac5a66f73484a5c297652c7

SHA1
a746502c4dc7fdcd1b1409015e9c138b51280d82

SHA256
5fae060c54707f9677d70478ebfcce415342f4e2ad05625ea8e3d7ee9be29149

SHA512
3e85c24fba709ef52d613f1ffd743371b7e77d7521eb1b8b751564539711fc7c7502425c2c5a7e4227228939b55f190298c065dab24e876fa8c4303f13c73f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
7c86862e89ca9e2a63c27571ea10bf7e

SHA1
e576e99169d12e8334c9b3bd5f74d092f45a4070

SHA256
a22527383bd36d7b8a830ccaed7b80f78f00ff3ba79a574ddf61c66a8b282bc7

SHA512
602ba5a6ba539f06791201cab637860bb7280d9e4028ad0fd5d4155b888212519a20b7ea8e006245b3933f3a98577ce31fbdbfd03920b99315f282bef2fd98ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
1f2937ccdc549209fe38fb7ecabaf4d3

SHA1
66ab999ae9a69c9c8e71cc501578db609e1c4c71

SHA256
15f4b09a97d44a706f85e350da1dbf23fc1c1522487c630432dabc80a26eb1a8

SHA512
8476d1669c51d9daad2e96e736cfeac4626dd0d5c455102abc7c8e224ebbbf8056aa358cc302a78a511497a56a5b9c3848133fd5978fa86bd63b8d100870695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4851d5fb25a05b3c8c4e21fee4f1b333

SHA1
a597caaaae9eac09099ce603dc63b8f5e9218f57

SHA256
caee0f863de56cf9f81ec11847eae3ca5d3775d99872694f4fbe71845bdba18c

SHA512
eb75622516f62e9b5bc558537e3d314b78d7ed89efce70ce3cd8508220cbc9c9541b34ec6f1d093ba738bdca7cee3bbd2e376b6f685998876d142cbc07bfa84e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f433.TMP

Filesize
48B

MD5
996b1efa161f23ba8d8daeb010b3829f

SHA1
db6d29793f1dd726db3701e1eb2ff9b0b4b84397

SHA256
9deb830335c5bec798d354343377fc20b43ff93d273f277875dd4b00627585b1

SHA512
681008fd98feab62ed29eacc6da674854a57a8c93385ab004cf7de6351b5355fad8398cd192e2aab433fd34c54230d40de09e254547e7740b3478ce248ee2720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b672e8687a367cbc98c795c50fc2ddf

SHA1
09e3d8e66b4aa1a26d39d68de02c6baadfdf0d6a

SHA256
d9c7ff3a4b6979b26a5544b0dadece43f917bbe484d34f359749c2ed1dd872be

SHA512
a6c839224539f93f7734a93a636d86871cd3640a5d0a3b4057369a12fbbc549fff9e093cb196eea3a4b9f1f49c38aa2ae2cda7051053165a9c59ff391b2b3d1f

Download Submit
memory/4088-46-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download