Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
9f26a812509da29964cf031ce92a6c69_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9f26a812509da29964cf031ce92a6c69_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9f26a812509da29964cf031ce92a6c69_JaffaCakes118.html
-
Size
39KB
-
MD5
9f26a812509da29964cf031ce92a6c69
-
SHA1
deb832bc06c42265008fcbac4471eae208cd8b8e
-
SHA256
2a8b21b5d2a6627c9b12e8ba348fe343eb1afbc27df128f4108051cca7132445
-
SHA512
e3d0c132e50dae965c66ae51ef5eadc1b3b0cf229ab76b25c866944bd23b82cc6d1f53641533dbd9e20ec78d61a1358af4757db7500a2deb2fb273b82a10ce06
-
SSDEEP
384:aVeTiqQgtdlmdL4nExwKMWl6kguCAtZUdteL3WdK8R3i1Q6k7NEuj:gSnqVMWl6khC8qtQWd7R3iC6k7NEU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2336 msedge.exe 2336 msedge.exe 4840 msedge.exe 4840 msedge.exe 2632 identity_helper.exe 2632 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
msedge.exepid process 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4840 wrote to memory of 3164 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3164 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 3776 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 2336 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 2336 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe PID 4840 wrote to memory of 384 4840 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9f26a812509da29964cf031ce92a6c69_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe730346f8,0x7ffe73034708,0x7ffe730347182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:22⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
552B
MD595bf85829afec77526d3611f05c7b94c
SHA1a6416825a10d2104dd8aaf1beb9055d3d2dccb86
SHA256492e1210edafc99953ec8ff29f4c4062f8dc90924511394c45be0fbaf9b84dc5
SHA512bb92fced92248bc188b68a6db8b48f0d3a4e0cfbddefacbc9dcf7cec32201b0d836509cddb20886f973e89188a3a50d0150aca394f41b98a2843c74d1ed589a2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5114d938bce06036a45340b5b2d13dcdc
SHA1dbdf8cc41225c8c4dda690d0ed0b0cc80d8d01ad
SHA2565f094f5d5e0be4b13e1732d66405a3dd1823c324188985f573fbaa7a59629daf
SHA5120c0432b5a6d00d9d784316a819ba0065675f33b32dfdd58d830cfadf1d4445ecb6429cdd21128b3560c89e31aaa76b05fbeb6a740a1d8481052ce702306955f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56d82b670609299555578506ba8c3369b
SHA1f9eeee86bea33c507b24f5279911e5988f39a933
SHA2563e16377b7ebf7f83ca576f67694d1f7261fff3de05b8e2cf743672eddd74ba09
SHA51266dbc4bf49fa2fc395c023a1d367ea7c560fc3286a7aa0acc901bebf20186d064976d096657c093f86f179e85a375643564993827462f8902a23f3c85e023a0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5194fc82131d0e76a582df8183ae9dbd8
SHA1a113b57f156d356b47dd35f4175fe24569f5f033
SHA256babb9d91e66c618300b6b9c68cf5f59e7feb50f1f607a1de23bc13008de87766
SHA5124dfb115e0dd917225974eb7407d479d9553037c197e374dfe2c020b6323bfe724b9a8b4ef4d2aee7b585fbb0302da66ebfe4602bda6ab6bbec1dfff12f3b1480
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD542c2282c23a90fc38bb437f389d33275
SHA15f87607cd2641f31894daabe89908d5d484539ef
SHA25662c18a9e4c0bf33588d01db793e67ce5a8b94adb30fa408a296780cfda18dde3
SHA5121e57c0f8123dcea647f6f3ea25df8f91e6e9d2471974fae24f50980d73086afb0c9ef541e8e227536c57abd93a0284e7591b3ca2e271822187961e5d2b9c7efa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD501a893963b801934672427c6da7e2876
SHA1440ab8d7d0b8ea726ffbfefb97b91359a6ff7565
SHA25655f7b9dd73a54eda1d59ed954cbb28f4211a57d776c62b5ef63eb2732aaca6e3
SHA5124e716d6c772fc5d651e8f3d97b7aff03133bbd0466774148b9747b9af44fa2716c860b48b799987a8377fa0cdd983b27b56fa2d9f9819284e3236d838c145e43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD54c023171d2b7afd306ec63c0d37a209a
SHA177801bccbb24fe79a57b37fac8ca6efa58615d9b
SHA2565e7b16b8d6df6a00a87a1828ab69ee57c521c65aff811fa4d27941164b779ffd
SHA51253ab81f61c9ad931a501fea84a0e89cdcd5241b51ffde06e4931d2a7a7d8b8cde8a8e40c69d9cd0858a03a02c499715a80e67f16b39d614be50e9d300c103505
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD58725f3c8ff25461566d5a1718fd629b5
SHA16915b4d2ac0e5b3f7324f82612e855bc27c7d375
SHA256769e2e7130e762754ea5bb7f1141b6e3ed2e9aee5761e624fb3881f885711216
SHA5129f2a5491e7d10bbc0433c48d7217ac1b4655b757135c1d41c7f6da650e7a3e3a64b8d228fd61d99021941ec03bda9a8be4b2d32f061f6b9dfa8afaa16e4a0796
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD58ca38943060c0249d84cdd765e4b5866
SHA11d1dee386b83c3e43b7b1ce8bebf7402e465ddf6
SHA256633b2ff76c590e4a83274da74bc5837260daf455d61b3835e2c4cd0a613689ae
SHA512f2f68bac4fd6c8abbf665dbedf3fb89b11a1f7c709a82f42b9dd8131ef6108a682e3961769360c078784f6f1dcf6f29b7507d733f1440ba79b76233103308c6a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579069.TMPFilesize
2KB
MD51df054e4c265a7e5ba1ab70794362c9b
SHA19af0f4de13604f7aaeb7010d7690bb88d7f77426
SHA256cc98c3c0872b476100e0121d61e5f674f7227ef4f92d25fafa2f5c7b50e8e22a
SHA5123d0fcfe90914b9354c20ba4db3497832bade089711c4a540cbf5b604cf893dbabd027244a7bba078b8def653f41de77cf99f3638579d9f118e7ebc3aa8ffce13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5ed8f2e66df069ceb7f96c7f3dc7e96d9
SHA147e2bb9408d44b257b8c463094b838b98dd7a8ff
SHA256fd2b4bd9b2b985c72141f0432ee5505eb6aa7da49748eaba8f40d128ba3b41af
SHA512186972450014de1e22b4c0320196aa8be8618f1e71ee3831034471aa7b0654716dab6f50c14a7f47f1c9a5ef0729d3089e629338977736db632816de079c167c
-
\??\pipe\LOCAL\crashpad_4840_VICTUVEFXSDJIZMKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e