293c2b2d593ec4e47d29f9bdd231b7f651dbfcad3dca18583cb123f9ed713c1b

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
Size

621KB
MD5

f6f17c8a2127110b8392f64158c49d1f
SHA1

568f7491fadcca0a5e09b0bd0c2a294b9e2b2a63
SHA256

293c2b2d593ec4e47d29f9bdd231b7f651dbfcad3dca18583cb123f9ed713c1b
SHA512

066cbcae003082a1aacfff2825c87af00920a4ffd15430a60c777f56eefab8c661b05f5dc04c6599585829a80685d83838a7a21732cefd6690a1a505cb0d237b
SSDEEP

12288:6nl59wFrMA6dG+m7JYDClJb5Np1XT0ceu5bQb8zvMpaq:6nNwFrMA6dG+IJYDubDXT0cHb68zBq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
4444	msedge.exe
4444	msedge.exe
3732	msedge.exe
3732	msedge.exe
624	identity_helper.exe
624	identity_helper.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4444	2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe	87
PID 2268 wrote to memory of 4444	2268	f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe	87
PID 4444 wrote to memory of 3808	4444	msedge.exe	88
PID 4444 wrote to memory of 3808	4444	msedge.exe	88
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 1728	4444	msedge.exe	91
PID 4444 wrote to memory of 3732	4444	msedge.exe	92
PID 4444 wrote to memory of 3732	4444	msedge.exe	92
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93
PID 4444 wrote to memory of 2988	4444	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6f17c8a2127110b8392f64158c49d1f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wisedownloads.com/Installer/Complete?source=google_dm-display-gb-336x280_v1&reason=complete&user_id=efb8c8df-6417-4a56-8df6-610d00ff061e&ask=False
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b8446f8,0x7ffb2b844708,0x7ffb2b844718
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,587802248852172231,634877849936626829,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
39278802f51858b9493c32c027ced111

SHA1
9165168a51ab4dcb6c09cc35415af4171dcbb0ae

SHA256
cbc3121eec22b0ede4fef35e2a756af6809c1627c078c2d97558f01ddf39dac7

SHA512
9011ece6517b4024f7120e4d539291a473aaee01015586af645c01a42457dd7ab379a2dbab2c66ecc9c96c79274f64b4071a8b63f7726dc3a2a27e3b0b300588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
ccf8a108d885dc1eef2422ec2cc6e6d3

SHA1
8c7e220988e9e4647629804eb593b69f152e8e5c

SHA256
313c43111d37d10d4dc2c2f838f06916ca9867e0f58e7e8b859c506850515a0d

SHA512
bef5f4fdcf82feb4af3e87ee9766d3cd6418719d12e3c543c1ac985cd26c54ab15e1668a2a93d58f742d316bcb60e437099edf54bb6c91e41f72b9366cbb1a73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f185459b630ba542f1a38a867dbc1601

SHA1
e8f6c496d0f8f9c188424f77d79119f641375973

SHA256
96b88cb1ddc8b946117a23e5a033cd00b3332f079bcde547b55a4de9c2fa56e1

SHA512
797e4a2b3b1f7c297ce192852f4721610548858881a1dc86fa8acaa349196b9dd783ee3a63248d5a0c20c327d8d19c7fb4bf593d28d911843bfac0932693e592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a8c70bd8a71e240860ef739a54de0a70

SHA1
59fad472bc89d209e98c8b0d27f12b0f085920ad

SHA256
6ecf99257d0e5219cce8e7386c6f7f8e510d805eabfc0beadc7e9d4460fb7c8f

SHA512
6d41923aa616a062c617fb1554ba03a4e121218f3f9f4ba33d7870b45bc39a0767eaf47f4e451ef239766b24b9b1189f4c04a723da2111d454d2adc0d9010a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
428e5afc86ed9ab3de7ed4a1330d5323

SHA1
abc26141d02bf72a7693cd1e2c98e17b7a86e298

SHA256
4eea2010a734dd588ce01e4f6ea548937c9d444ff3fabfd2292b278315586afd

SHA512
3ee1a77a18d28dce655cae3fff8ad9b1bd10279200a7ce1f9e2e35593574ef33581d2f3d319422c3a920a390e8be5a521ac55285277a9dc7f9fb95bea226d539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de99d08f15e2f0e8cce9ec70b6e98bfa

SHA1
e40c704f9eb44ce5e92a8f8d1a7014eb6495a569

SHA256
b0ae4d2305e0f92d7d19b25fb09b41cba0b4dea5d23d8d1609c0ac03b450f665

SHA512
4af2272652552c0af12b41eb6e4604b9d9c61f0c666b5672602facb9775ae610f3bc019b888a0019cc6e25a52739a87dfaf37034085bdd2f242d7221309fee38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4c9b77c9cdf42fd248203ffc1ad5eaf8

SHA1
1214e82a5b1b7d83a6cf182c9b6a0990aeb61530

SHA256
53e32063c38946638e1642d486a18f531b25f6ab1602c1de88ea945e7443d4e1

SHA512
c2c9efa779a62abbd08c461475971b7f0ac30ca45045ee4b3bb22d307b47dcb7ca768f0bb3e9545f32443dc37adb46c746a57387361648f1977a213236419848

Download Submit
C:\Users\Admin\AppData\Local\Temp\offconfig.temp

Filesize
6KB

MD5
4406c46ac850504e79dca75deb2ab945

SHA1
ce685bdb7d7837ed49006979c29c5bbcb3b98bc8

SHA256
d24dc20caf9038984a9d2331789d8006078742e9a02015d7e68cdf6558d6815c

SHA512
b3ab2c6be9ef2899fa6499a7c0547b53ee7a687d41fe7918c01436bf5870998e21b4585ca1a667842fe6d3ae7aaf32842351ee8b32eb3cf6d6c7b563bb1cb525

Download Submit