Analysis
-
max time kernel
137s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:42
Static task
static1
Behavioral task
behavioral1
Sample
648635f16820adc9517c49f21936e490_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
648635f16820adc9517c49f21936e490_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
648635f16820adc9517c49f21936e490_JaffaCakes118.html
-
Size
61KB
-
MD5
648635f16820adc9517c49f21936e490
-
SHA1
9aa25545a1de56fc3e3e1a2f05ba9c3d1e3abbce
-
SHA256
b74d4771fe382a6a334bbc3cb1e277ea4cd98db625fbbb4759cefa0ae16a136b
-
SHA512
d1035563434596f285a4651520ad188921b04aa2c09cab3a38e3f8f2d90218e03cd8f7defce48896059abca8420299c7f675796ec4b53041268eb3901c7f24ee
-
SSDEEP
1536:e7T7FPYzRIJQL1iF+EewhcH808Vgloc+k3eZrrcJclAolIarJJg8vqrOtjynqvp:eDCRInQwOQVeeZrrc2nJg8vqrO8ip
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4628 msedge.exe 4628 msedge.exe 1848 msedge.exe 1848 msedge.exe 3468 identity_helper.exe 3468 identity_helper.exe 2588 msedge.exe 2588 msedge.exe 2588 msedge.exe 2588 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1848 wrote to memory of 1852 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 1852 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4260 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4628 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 4628 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe PID 1848 wrote to memory of 3824 1848 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\648635f16820adc9517c49f21936e490_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe8ad46f8,0x7fffe8ad4708,0x7fffe8ad47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2728 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7878462468923122617,15892507489899081645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000aFilesize
22KB
MD55e74c6d871232d6fe5d88711ece1408b
SHA11a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA256bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
SHA5129d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000bFilesize
20KB
MD5b6c8122025aff891940d1d5e1ab95fce
SHA1a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA2569954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
SHA512e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD576282aa6002d70ec23fa8a275faddfe5
SHA1f11083656d8626c8a4142a522fa7c14b6f67e222
SHA256299a097c8758d6d1f7ac248ac21ede66219186e3c0c422defc35fbface7aa642
SHA51270eaec62cafe1299dd57ed92b38168fc1a4d7680a8b7d0d96afa20a7bc8e22001e27b40ad65455a5528a5066c2ec347f92b9aead5b1ee7a25d53cde82909763c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD56df005ee9eb83f033bfd5856e849976c
SHA197466672758d6a5ccd92cce3eef4e5babcf7c4d7
SHA256988424d568ad1843d2ba1a3caf9c68f68e5f9f9b653e471b52280a0b9dfa24a3
SHA512f3b0fb251b82bae61329642f17ae37b6e9029d7a8480f7db7929000cd7545ac9947660cfc5d28a16a3d2a56b83bdc6df79740b79f52467f4815092a4a82a8a38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD58b1f8fa1709dd24efc1b651dcb52bfda
SHA1cd2010465642fb73ae80026758f1bf6fabd79202
SHA2568e9ee19e868b1333bee10ee9feb57bba12bd585457909f0ec75e9860cbe5e54e
SHA51248549e6011d8d278b1cb0e929c3b39dee5366fef9381a36dd96bca8af957be57343cdd983ddfb607e17421d1346b242634fea72636757f99602b2948208986ac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
96B
MD54541f0e91963928e49c7a662cc31eeb1
SHA1d68419dcb1402de65905d3f31633b179e7d3f0c5
SHA256058cf685c65b81f606088e202e5c35fdc2f7bed2f67997ec8e0273417b3d80c5
SHA512e09eeac050b5df5b32dcd7bf0a3b935ef58b3b9cb48ead23df79b9f2baa593ee29d7770da056692acd2304d03ef1d761e34013b3dff48ca40b8b57478300cc48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5be80159b061e5a1a867e88199373e42c
SHA18b099a5751baee4c065f68fb5459c3409960d204
SHA25672ab89335af6856fbfc1555d9abd2f27a979a1f11e759f8b08f6895911f97538
SHA512cf154b59de82d4c0dcacecb73d99c2ad6874fbd996cdfde22a9b2f865d6d3e8fa1eeea1731e97e96965c4722c5b139f88fff611fd08477639cd6ffaab3568fcc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD526a305fa3a0ce96cfb811c253ee7c35b
SHA1feaa044e12fe659f92544e9f367e60f1ea360be3
SHA25660803540ac1f72258fed88971a52a168a845fa261d223bf52b93388063c0ffe5
SHA512d267405aabefca5b1dbc4454df4f351faec90cba0c6b2694cc037b574c552cdfedc2c528a9487fa7255b7e5995e2e05bde8fa0640cdb8c8b35b7ec62bb0c42c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e69860628cb8d31c567f5453d7395f00
SHA1d6459e1888e6d6d05d73e38308c8385870036bd5
SHA25655af651d6441b17ac3795ae7c3aa3d2ecd67883380543ba88ebeefffe5bdb265
SHA512f831e5cfdcdc7c7c400cb907d0d731610720553e6ac42c719ab9b1ab7fab33cef8740162d2fa3eac274d1eff80a72fb7b47cadee36c02bdf254f69bfcae2c5a8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD58e91a9c94d86a019c6feb859e3b11727
SHA1ff6453ff056d2afdb7f2c0c8a38b456798e76156
SHA256c4e721ff2a1c5fb83c5042f836826e19c50a95382c2b4476e5ebacefbcf5f81e
SHA5120630e21d94300544cbcd9bab1f4faaa24f9796ad64e897f7c7e61be75ec17c433a7eee6f24f43710a9f1fd7b87c7b42478afd5d78c7862c05523064153de9590
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5519373234fa16a1465a3c39e7bcaf84f
SHA1500b3ac67c36f3abeffc70ed90700b166aaf8714
SHA256b50fa19a5e3d4110be999a37bc6542119763e7e1461b2f1d5ce9e698cff1f3ad
SHA5128c5c84b0f0244536ea93bd6eb6d91727b5d48bf09081b2687e8e8ffc15429f766a87704a65350d8a05f21097a848db75a23feeeb7c2caf26550043470a376ae8
-
\??\pipe\LOCAL\crashpad_1848_YOIKQHGEPCXCMBTIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e