f842f0eb05f40db80a8ec1e568a64d6fe83d7697b52f84e6a860818541298184

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe
Size

1.1MB
MD5

eb53b27b0c075320e72313e6a52260d1
SHA1

432cff1962d8b3a4e580208593b5a6dad61bb5dd
SHA256

f842f0eb05f40db80a8ec1e568a64d6fe83d7697b52f84e6a860818541298184
SHA512

17c25364c039a2257d10c0e04d180af2db5f5fa2f41f969a7a0714a8558c2fb1b83630d31cf452b17eeafc23ad06291f62c4a7841154ff78ed6ce791f2b92937
SSDEEP

24576:sDKAZTdmRA4wxAFXiAArCxWznC+8PPd/4dnBl4y0:jtwDAAexWzJgd/4d

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
3272	msedge.exe
3272	msedge.exe
5096	identity_helper.exe
5096	identity_helper.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3272	4572	eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe	86
PID 4572 wrote to memory of 3272	4572	eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe	86
PID 3272 wrote to memory of 4668	3272	msedge.exe	87
PID 3272 wrote to memory of 4668	3272	msedge.exe	87
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 3508	3272	msedge.exe	88
PID 3272 wrote to memory of 1368	3272	msedge.exe	89
PID 3272 wrote to memory of 1368	3272	msedge.exe	89
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90
PID 3272 wrote to memory of 5084	3272	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4c9146f8,0x7fff4c914708,0x7fff4c914718
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13301632781228692191,12478358603789948279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eb53b27b0c075320e72313e6a52260d1_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4c9146f8,0x7fff4c914708,0x7fff4c914718
    3⤵
    PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\681191f6-3587-4e3d-a829-832408702312.tmp

Filesize
6KB

MD5
ad1a968efa4df411b899b494566bd247

SHA1
20ec26cc8e38e745e9c607f31d316d431fa821f1

SHA256
17ed05383c528a6bd4358651734b67d55ccbbc2b71adb95b33747fafb863bf94

SHA512
a11706cde7edbbda0fb54ee634072cace4cc39b89a3885bbeff4639601a8583f2796af40c21d8bca474be7fa3555bdc425184aa5e19ba47d153d3bc1cc8c4f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
87291920226eaf78d56ea6d02dce89c2

SHA1
f56091d767b600ec244c4ad2c7b2b56e27123298

SHA256
7c213d63a8ff399d525ebd4aec4705d52b68ae47eeb515ae7774e769d8696c4f

SHA512
54c781d83fa81c5c86f529d891a71ac7aa78cc5ae33cf782d74b3e49aec0a097d9371ac0c3e14d06c44a84506258fcd2c50efa6f60619d57a109cf7f90850eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b430e7d08a3e611675fd2f57a15c9dd9

SHA1
88c65ffaf4b0cc9598104bbb4c378a08a37f5f62

SHA256
b0857489dcd9f5a1e3f67b404750198dcf5d6b2d4a2da2fb25e7534084b23033

SHA512
616a61a8b02ee8bf6aea98a50dad6314e13fb1fac424bac30ca3bdaddc8dd07fadb872e2704f6383acc4fbe026e0611977aa5f31e2cd99cf1814286b5bfa333f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f933dc280318c501317b743e15a929da

SHA1
b6afc9a68a58bc2b9cb4b5c2f68d1fe8a3dc9d5e

SHA256
272198cc27c7fa986b8b15fc82471a1bf151ef04dbc74dae5f593172a2c405e0

SHA512
c07d977f194170b1c4db3f8eb83e80f8bb6b3bc1bcc2f3df026b46d0fa458df6ae58ccf4701bb5bcd6106aeb0f8657847caca909ee160a4ad190ebcb144bbb79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c843ea6eb588b8fc47c8ad7a309932ed

SHA1
2601ec6d97b7a5e1b88c326493366a08165c241d

SHA256
07281ed3eff0f811824f8b1cb844d07b668973f788277f859cdc4e5c5cf861b9

SHA512
48ee1e9937e7ff58c3c966a3f70205a07aa96c8df6e83fcc6c983d7be02072164a24444d35c3acf259d825110a4f64fb2051756689702abc058384b16084bc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580606.TMP

Filesize
371B

MD5
85e8334469b132002f0da7a020337b71

SHA1
2dd8e27d9ef83e061a9945eca421f2d2079c0f5f

SHA256
20d8e59b42db70eb0ec3da019d999ddf81336d7047d4ad0ea5ba77fcc8ba4d1a

SHA512
25d795234a4c430803f208e0d68b117fdd357a20daa2e1887f8b397e04e115dda78c25cbcc7b54acff5dac28c0cae8ec741107409cca375260349f6dbc065158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9688bb3d147421ce51e61331d902029c

SHA1
f11b02df7bafb69d5e6a820059d2111c646bb732

SHA256
9d49b38dd946c49dc60001814f85e1c406390f3f73a3f8b72727bf1d609674ad

SHA512
fec67a4b80784329b9a3e4be9c0eeb0c85f1f59bf91d029184debafc41fbfcb11ff01e8c93c6d2eca8fc6788d5f14cc1a18f4179613ad0dca73875e8544af525

Download Submit