Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 10:24
Static task
static1
Behavioral task
behavioral1
Sample
adfb2a943bc26e851482273d88e4abbc_JaffaCakes118.html
Resource
win7-20240508-en
General
-
Target
adfb2a943bc26e851482273d88e4abbc_JaffaCakes118.html
-
Size
246KB
-
MD5
adfb2a943bc26e851482273d88e4abbc
-
SHA1
55d80ecd8fe94f7a0a32347dfffe9db39106cf6e
-
SHA256
2b1f48118215d0a4633cd6ae38806adcb7de423ad357fcdbc6db1534dacae007
-
SHA512
eeb6aab572c1d25241e702b4bcc551df1ceb2ac12405ad7e24bd4003b6f5e4e7c1727f2b7c226bbf8df325bc0deac1c3f1020b994f8e0d971e03d62cb3396a9d
-
SSDEEP
3072:hyTw3d8ifZG1C2bRmC/f7nPNATNmnPsYWAUbiM219G7jJZKeVn6XyGwtBzMKMt4f:bt2x/zEmnPtoXN
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 100 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2692 msedge.exe 2692 msedge.exe 3536 msedge.exe 3536 msedge.exe 3004 identity_helper.exe 3004 identity_helper.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
Processes:
msedge.exepid process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3536 wrote to memory of 1828 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 1828 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 892 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 2692 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 2692 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe PID 3536 wrote to memory of 224 3536 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\adfb2a943bc26e851482273d88e4abbc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e77d46f8,0x7ff9e77d4708,0x7ff9e77d47182⤵PID:1828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:4880
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:3248
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵PID:2980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:2832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:4628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:12⤵PID:3128
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:82⤵PID:332
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:12⤵PID:3092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:12⤵PID:3900
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:12⤵PID:1692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1055894714105314849,15558470674842036480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:12⤵PID:728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1884
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3908
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017Filesize
44KB
MD523536ccfe05b737ae639fe63ee4cc435
SHA16d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA2566ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
SHA512f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019Filesize
32KB
MD503230dd42f79a152d4167da777b25930
SHA15fb12828c21013decbdcaaa6a0b172958319a4b8
SHA256b38bb176acfe61a3ebaa9dd41cf299f0ebfe364762b213ef8281f750eedcbbb1
SHA51279a24a7c52a0023e285266b22dbe9e53aa276f8dd1db93545eab857510d6bfa7f1bae76d3cd09910e9362e32a341ea679d54fe1abca6965976c204279eb2871e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
408B
MD5bc4758539b493e398d3dd4e8132b60d2
SHA1196a53ce3b27d05a18b3e9ac09af7c849c5265d3
SHA25653017a96e320f9f519ee89ad147be0ef8a8c5ecdf46795d27d4bc5f9cade3039
SHA512ce6b13da8ed19a9f407e0326402a367e7554b1c4d5f8159f8f45eb5d0540e05ed5f98e2f7678bc829092964e789070a422bdda5927a93ab3add927fbe9ddb87a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD545b7dfe6f13dc5aae96d3a7170de89af
SHA1f4a6bdf7da65360c2712e057d0e5f505a06f4157
SHA256d0c627903013217d754d3c842a2b52af27e670963680dfd2d70f947d4f76f5cb
SHA512cd9dab721bdded6dd5eca57ee8daf6976512eee1233bf365ab5d5e70b6f6d14c76985628572964a3fb5341f4efefbfdd85710747c92297fe5451772505c27977
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
432B
MD52bd0cd37eddb04100ea26a5f4873df37
SHA1cbc6e72d146950429e73905c557e5834a32a2048
SHA2563b3f33ed07bf13e75c51ed75422688ebff8d3b9eaac1debd86d791f13309bc6f
SHA512ee9d23596fec8e173ca22a5aaac4b46f2d6810725950fbf4a380dae6652b6cdeac902ed1f7dc28fbabf95f13b6115d8301e56798cf82cdeac1fc41ccf39d67bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
4KB
MD5c0b620f7353f0d2ecfb5d1a5ba7db003
SHA1087ee540179d2bafa5a968fcb69e95ff92beaf1b
SHA2561f72e50181492c73e35009bff033ce4aded271f43cd2d41b0b1439ae9eb58c52
SHA512986bdfddcc705c643bc7afeb3e339e83de2ee9a7262a47f47d1c04602bbfcc2dcb662519a57ac3d8ff6ab0cc737008e11a2f8aa7614ab0fce651be85dd65378f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
4KB
MD505b51b85d8c987f80e7de14baeabb772
SHA1c54cc6be9b48afd93a385cfbf952b219c2d51db0
SHA25653d5a241221f3912e4c939889bec32393a0426580fd9f9ed909b33c3fbf16797
SHA5129b235c3b365fdd4494ab608d8ad7ea102119b1d2e70b492b71b56d45e182a188b1ee8a3aa1d508f1ba718feebaef61fe4c630342c65fe2fe3071b52b5319317d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5ba0b0b87e1a809a376a4491f8e0d4751
SHA10ee6df04801ac366c0e6c48e5cc8ad71b28c43bf
SHA25683647788ec82552ba84bc84e4f0615b08c385decc95ecf5934bfa84436a541a4
SHA512dc91cbb39cd850d3063e3ea283f7d5d6259aca35542b068a78a55c312509c24c9b6d3239a5c46dabaaafd800d284f7864385f8dbff0b83930627b92bae32a23f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5a92611ad993b673433763c820653faa8
SHA198029430c107fa5cf9b16314346ca71c538b0e67
SHA2563b436d77129dcfb022569d04c47ffaf096bff2af4f52273912c151c5cab2622e
SHA512af1416d0696c28fc0ad7ede82334868860f872e8d411134bd2071898f3883eab0b8790340675c6536c4ec985d71b37551cb4e6f5d7e4fbd2ae61555750bbafd5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD59087cccaefa6a8888081ddc63ea389c5
SHA1f7fe59c005672d49728f883c5d3ea0525c8054ad
SHA2560b3e2b7f7d62a8ca83bc6a90c823969fd76b9ae52baec769e56c751f2a28257b
SHA51271bd971feecfbedd8fa033f8aabf5d956d7ddc3633aea653685b63b5f2ca043e5593233c98ad7aa5cd9f7d2379ef4c3954f68d9c5ccf8cd5f1a8fb9d71ea6357
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5f324ccab38fb8400777e7ef30db6b279
SHA1c8cdbaf6de2b986fd496da5bb0c63d45418a15a1
SHA25648a3655a36bd5c1230ce4c648f0c1a4794f4268eefacd290fc86b224781c13e6
SHA512b5ee26330e0d5eb2a8dfa856ccc5be5e6f47c46be6b096952efaed6c6e973a78c4c0afef8cfcacc85344d599e834a7109659fa79cf1e0a9fe1c23ffa2a7e2a79
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD57aadeef68b25cd1f9acbc2e092b14881
SHA1e3e1924ab90dceb59f91a35f8e77a59ff6b3a699
SHA256cfbded02d83b37587f50c1f17c9e8cbfaefe9c90d8142844aae94f800b466fee
SHA512703fa697c92cee3d9bb9658bc510e465df605d476532af5568928d96248af69006a0d5edc8a67e19a59107c84653d8d2a33d6924b6376712f73dcef7b52e1d70
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57824f.TMPFilesize
1KB
MD57d2cd7dee156f53fefb74f55ff6cc72f
SHA1b3c0ae89c7da5fd1a440c6df528d2cf78161b59b
SHA256ee23118be19aa3570a77d64505dce46cc1527d2626c339c689794c6a51a46d7a
SHA512db330e80a8e47c632a07f921b05eb9f99d1a55ca1c2ca91abfbee2ad967ceae5b0d2604b87d8a9a1ee857649217e1f2fce4bf1d4c7e105e8d6707d11514b53de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5fd2abd23f31cb6ecc6d20a0788d11c0d
SHA1c15d6c63a6513d9c82cf5d0e3848c85e7389d298
SHA256dad7718056dc6ee8194938badde591110971bdf3968457b47b1c03e280e64ac8
SHA512fcd9e696f6f64b5597ca01a65f168f0e8f37d87ba674aab969adb4671ad6ccdb349b156d8194398750eda94b1771db9bda2310c4abda165b9dc6b4fdf8a86a8f
-
\??\pipe\LOCAL\crashpad_3536_FJUWDIDFJXAKAJLIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e