Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 13:04
Behavioral task
behavioral1
Sample
c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe
-
Size
512KB
-
MD5
c8deec610d55ac8f4847bc2f4d69e1de
-
SHA1
9a262a8cfb713b002e69f088c245ef77d16a64d4
-
SHA256
bbb582bbbbaa63737332d290eb46c958499105d89605f8e7eea3cfa1a526d85c
-
SHA512
0fe5191f14f8042c827bf9815dd1d4c72294abe0d6fc11e6f117edda68fc72bb427945da241b6acfda85561bb22cfca9137cf910825ea62be5e61285ab95d07a
-
SSDEEP
3072:JQp8NErMEYAcKNvUEy7YKPvRW1CnqZ5JAVtD:JQmO79nK+CnqZ5JU
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2436-0-0x0000000000400000-0x0000000000483000-memory.dmp aspack_v212_v242 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe" c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2200 2436 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Download c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001" c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1320 msedge.exe 1320 msedge.exe 2400 identity_helper.exe 2400 identity_helper.exe 5156 msedge.exe 5156 msedge.exe 5156 msedge.exe 5156 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2540 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2540 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2436 c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1320 2436 c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe 94 PID 2436 wrote to memory of 1320 2436 c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe 94 PID 1320 wrote to memory of 2116 1320 msedge.exe 95 PID 1320 wrote to memory of 2116 1320 msedge.exe 95 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 3160 1320 msedge.exe 96 PID 1320 wrote to memory of 1748 1320 msedge.exe 97 PID 1320 wrote to memory of 1748 1320 msedge.exe 97 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98 PID 1320 wrote to memory of 3432 1320 msedge.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8deec610d55ac8f4847bc2f4d69e1de_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 3882⤵
- Program crash
PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=vsd3g0h_vs02⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe4,0x110,0x7fff877446f8,0x7fff87744708,0x7fff877447183⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:23⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:83⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:13⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:13⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:13⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:13⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5636 /prefetch:83⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:83⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:13⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:13⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:13⤵PID:5248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:13⤵PID:5256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14880103578683852019,1116893591534376494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4100 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2436 -ip 24361⤵PID:2640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3392
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3944
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2d8 0x5341⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD54e26a50c5eb7d54d561ab5369f6719bc
SHA119cb7b80c598582f4a2d1a6102546adcb7924dc4
SHA25600872f974c02951465efde0206e82f83b36d0b6c6698dbc53d4ee23463741146
SHA512c2142b4a78b52a0c59ed4a450823014d97f7b5ebe9d8960466a029a8c2dbee9c3b319e2247f3861412383322a91dd9d5401383478b8458cb34b5b5bb555da75a
-
Filesize
2KB
MD5b990d3ce73636290daa783a4d6cbba64
SHA1504207eca454c9bc9cbe00af30e685c003bec13d
SHA256322c1a4997ae1dbaf890859d8cbc59f2739df069d0764a735604258ec0a2c31d
SHA512ad4e10daddbd43195ad264e876d00ec2b32c56748ae84220489ad642ec8100bc0fb88fc547468a6f13961eddfdb2d7e28e5f8717f0a8b977d2a7477e449a5ffb
-
Filesize
2KB
MD5e371471df69362c889ea0990ba01ec67
SHA1307d506e6a5cc31f51c4b67d0714b505a1d7cfc6
SHA2569678c242ceb225204aedc98c02b5b67865a130d0c40787d8ba47423c3fcfdd90
SHA51280558133b2b0fb89528dbb1b58dce265b9f893fc2971075331d4448adfc272a6f6e1f7abffed5f42c29503d0af0200bb726617fa2a32a895cd5b6a1dca7b6e36
-
Filesize
6KB
MD5c6373b955212d76cad1b66767d4c9f2d
SHA17eb2e7b76e1f1d313a69d70e067f6b9a63c49bae
SHA256a08593e78b302294ea8ba6550c5d2a3903e5cfa371a719c73bbd77bec40d3313
SHA5122cc70df6eb076be7710b1ce92b61708aabf34453f08eef0b111343dfd328afcba7b8e32ddb5dab5c80e928868127d692db525b9a50dd3b3f90baab49c291daec
-
Filesize
5KB
MD5c656bc5a51b670da355d24c85a64e5d3
SHA1b818d11cbe730e8985e8b16800b021550d7a4fe7
SHA256542fbec26f8f082bd0c4e8ecabd4d3bd9111400621702d64a2618854b1623678
SHA5128e71567406dffd545ef254d93292b6a4cfbdd803547ea46072ad5c534f6b0a9d052dc20bcd0d5055a2464000ea1f76989fa392a422da09d0372265530f46fba0
-
Filesize
6KB
MD5b36922abcedb4fe80569ba697b3e1c43
SHA1a9f12b183c631fb310fd061ec5b4dc28ff183f57
SHA256b2a59e54e92d2cfb971f05416a9de5c8951cc18ab08da15d9c59bc4ddeeb4895
SHA512634c4ff4a15e512ba49dc59b1e58613031f06f2550e500e0e5bf959ba58897487a321d6cccc6f0ca8f53ca91a8c793d626adca3eaa1d1cf4041aeab57e9b0766
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8bbaa9a1-3f5e-4058-bbe0-0e445fbfe4fe\index-dir\the-real-index
Filesize2KB
MD5e71e4a097091cab0d87452a4aaf8f5d3
SHA11f1083c4edcd83b2fceefb29217b541a819036f4
SHA256c3502246130e8a1ac77e0c081423f772155fdbc0db205bacb5b401dca6337a9f
SHA5122597d208ece060702b34102ff7efb6a2b8850e9dce9c9053de6f49495d3b4dbdf1e2d6ee1be0e2d9fe1396f588841462ad191b2ee431779c1268f0e23b6c60ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8bbaa9a1-3f5e-4058-bbe0-0e445fbfe4fe\index-dir\the-real-index~RFe580ccc.TMP
Filesize48B
MD5c40ef74fa08e4421958e3e08b5fd406d
SHA1f9e6cf0c3f08ac3e9c274da16b132d9e5f96ee47
SHA256ad8378c9edd222f0120c74d299cefa715edbdc218c7957809c0aab75167c171a
SHA512a8806a138453308e86a804d7c6a0a09061bbb08b6cffd23b9bca9628a6e9850aa5f137e32ad272c0c126c3b48e520a815a84f56da97fd050094a57469bcb3561
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD572bbf41843768ada49bf15bb2887eed4
SHA1553536334d5669107ac5c5b814c6e8dc368af268
SHA2567338f90c478e30a39c0fae497c245545eee4d97e2eafaa39411f39f25295da2c
SHA5128585d3ed3bfbbd0ec31e9b1f485dad4b3ab7a884f98a0f681c04409c6c4bc72d61cccbe262184bed0b22f0a114b6dbc8ff24ca62cac7f630a4fb5b0ce0a46a1c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD571f9bd656d90df72b7d57503f063c180
SHA160a54bd1e92b7c7c61a1a9a1edec13292902ee07
SHA2568ed095328805a2d4b72f1fc2c88fb3e900fbeb731fe3ec4f4bf041f65bb7a103
SHA5125176ae3a99eebb8e964b1f477d08f8c2b7bec5947304972420eb7c4bd2ccdee7ced7148d07cda5a6e90b75fe56d493cd55a76a06d8dce020f4647456fd40d0fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize84B
MD599339ecf1e465eae7d65d7e603052423
SHA1f8187b8096535cb18c4f01708b0cb4cae51254cb
SHA2569fa46850ef8f0b7112bb34836ba5c5017ffbde5ef93498bea8012290d573f882
SHA5123066d5e563885199af8d5207e950ddc5367a84f5d3d068ee9f728df1d6f77966c4a05d27a600c535cd242b06f8a88a254602229c149905000ae143b6c2eac877
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57b769.TMP
Filesize89B
MD55355416856d24b23cad2d587116c0324
SHA129d8545e63dd9ca8d9d830b60480d114fdb6e4d0
SHA256a6c6da49364ecd43dbc2c7ae635f136448fe8cab9297ac1949857271671635d2
SHA5126dcd7a24fe7b0451a37802a42d1e4b9c1b28ee771c2c3e867d0a34235185991621f0edda9e15f1d83bfb2488ec095c8d7830e8bfbbf5d1486d8c3e5aa21cc596
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD52529d63ffb508e06e7c67815fd073ce8
SHA1371466c173a0de231376bc857505fc0b2c77e6b9
SHA25610573478f07c30ddc23231069eab41dd5bb810cfa64d634524fc88b7bf8adaa2
SHA512a8ede7e39f01767fdb14037b104a0f2272722fe2f79141a389fbff0618d28291c93884ac9c5e919d21e5cb7b19024b626d7cc1dac71186a9501e7db042bcbf68
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5806c1.TMP
Filesize48B
MD52200fed632b50352d8699109d337262d
SHA10d59e69e0652e3001bffdde023f71666079d7e89
SHA256c0370fd88e3c15d38f359117c5dbb3ccd750c0b44c19bc4878bccd6c75cdaa93
SHA512f458b4ad44e5984188cb74f5b9e6753fe43454471c651500c2995bf4e964f0ac625e8652ec640d4471432db8889fdd1d0c3392cb8481402f2d0773de1f0ca814
-
Filesize
704B
MD5b1989eaefe6145b2b9f5714b36c1ca84
SHA18bc8c91f4bf3cde6af886d035936d8d9ccc2a377
SHA2563ae8ab1c0cf91dc5ed9f49438f761d3c0871887ebe5196e6fa218d374dff7ee5
SHA512f79c7344d6f18b301e02d4c48b8427343ba4dfb8c252cfaabf4ff37c6d922129cd0e0de325def3c7c4b0b8f2fe79098c84a2e04c71eae6fe6bb443467552bf23
-
Filesize
533B
MD51d94a0d9d298543310cb968a2b9d3895
SHA13f4e9ff4f1990a24540e616bdc9fee0e10c74361
SHA25675a1a69424a11ac6ebc48f18c148d3c0f2a85e76ca04cae54cf9ef3ddb4aaa42
SHA5128286067966d6ab9987078a2d6be0e515184ae3fe88779cdd858eb19adb708ce7adaae60e20d69849a0cae7045835149f6de9583bee3d668724af83d21658f976
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5320cb624021ea6fb5e02fd4caa3ef5c1
SHA1002b29c75c4e07891e4e32e00f688e4c20079562
SHA2566d7b659ea29be4e49111eb5afa10a5667b434f44dbd07af87719b8b1e994f206
SHA512d20f3a33ce985fec3da5248377bab63c7542b82683bf5377a41e0f67c9f8c2e60d9029e5729d9af993ca2aecea68eefaba774a5f74b7d090c283bdea8712412b