Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-08-2024 12:33

General

  • Target

    c6dbb2d23ad8026cedeeaece3b1f8770_JaffaCakes118.html

  • Size

    901KB

  • MD5

    c6dbb2d23ad8026cedeeaece3b1f8770

  • SHA1

    d355551c8b1bfce1995072e9acd73a1a5f7f1924

  • SHA256

    8bc2b313d0bc9073be7690aaae6f506d66947980d4c80836cf6b5bd02c8be5e8

  • SHA512

    dc6a721fcc0d8a3fc96b076006605867a95ffc801cb43e6f3467b59035565e6b52ce64ac73b0148d8b0765636ee01d9c60830b495c8cba5a1ad4a3dbb155ed51

  • SSDEEP

    3072:GClktNWDFoS3ZGJQZRwyTfcs8rBh50/00W0Qasb2+GsHd50HNZZJ0JXn60h0E0rJ:9ktFQG6ZsxueZ0N6yPx

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c6dbb2d23ad8026cedeeaece3b1f8770_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9feca46f8,0x7ff9feca4708,0x7ff9feca4718
      2⤵
        PID:4316
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:4988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3120
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
          2⤵
            PID:3200
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
            2⤵
              PID:2992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
              2⤵
                PID:1132
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
                2⤵
                  PID:1572
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
                  2⤵
                    PID:4496
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                    2⤵
                      PID:4536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                      2⤵
                        PID:1868
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
                        2⤵
                          PID:4276
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
                          2⤵
                            PID:3816
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
                            2⤵
                              PID:4312
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
                              2⤵
                                PID:4784
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
                                2⤵
                                  PID:4632
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
                                  2⤵
                                    PID:3472
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                                    2⤵
                                      PID:4992
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7868 /prefetch:8
                                      2⤵
                                        PID:2740
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7868 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2960
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
                                        2⤵
                                          PID:1100
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
                                          2⤵
                                            PID:644
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
                                            2⤵
                                              PID:5288
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
                                              2⤵
                                                PID:5296
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7616105502884929632,7061424087975555759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6680 /prefetch:2
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5500
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:4856
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:1964
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:2648

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    53bc70ecb115bdbabe67620c416fe9b3

                                                    SHA1

                                                    af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                                    SHA256

                                                    b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                                    SHA512

                                                    cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    e765f3d75e6b0e4a7119c8b14d47d8da

                                                    SHA1

                                                    cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                                    SHA256

                                                    986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                                    SHA512

                                                    a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98267329-8747-43d0-8b57-0103b3273593.tmp

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    a453d8c58147219c0edf90afd7e3f89f

                                                    SHA1

                                                    d8d8e4c93e5322dc20a8a59c21962f8a5a201044

                                                    SHA256

                                                    9501d12ef56a2a1cb83d149bae14e0e82cc7cbb71d88e8ad5896314b55cbcd10

                                                    SHA512

                                                    2ca8cb800440328c2129ddb6de30b8fffc79bd88d5e00a651d91ebbfb1936f094e0933a27e6ecc29efa6953ef1cb13e62fa31baffcd53ef4d30926b722d579a8

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

                                                    Filesize

                                                    47KB

                                                    MD5

                                                    2b5dfb1918c67607a49e6f784b48797a

                                                    SHA1

                                                    a8830395cceb8de7687b3b751c6626546f307d47

                                                    SHA256

                                                    5aa5e0d95839092c4545fea0928eeffac76690e8adf533d97b600e97250dac8a

                                                    SHA512

                                                    eaab7c07e1dc33f43aae512b77a2217af2189aede83c97dc73f2be7a17da5b1a242f47c7bd272ab13c9513d837fce6ce0ed0114b27971543370413b2a9c5dcfa

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

                                                    Filesize

                                                    23KB

                                                    MD5

                                                    a0423f1305547bb6b8f5a4fb1a9fc2d8

                                                    SHA1

                                                    092dcf1fe57e6bb53821eb754e04188ee70602d5

                                                    SHA256

                                                    6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

                                                    SHA512

                                                    b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

                                                    Filesize

                                                    23KB

                                                    MD5

                                                    33a83c16527e4531fbfca2631f653674

                                                    SHA1

                                                    87a63514c262ba4bffc52d2ceebb3ca14353507a

                                                    SHA256

                                                    1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

                                                    SHA512

                                                    f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    480B

                                                    MD5

                                                    66749d987b5fd5acfcd4fbcb6f37f3dd

                                                    SHA1

                                                    4758a6eca7802280a548a95b0ae045ebcc565abe

                                                    SHA256

                                                    d2b61b3de200730bdd120e1b77a9fa06276236b1031660eed15d145a89029028

                                                    SHA512

                                                    a49c2ce891dc1d7673591ac4c004217e2b788846c5684e87d26ea4141bfdaa930b389113d1bcbe474e9ee711b127e264ff61837afdbfd25160bb6f65f67d5067

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    96B

                                                    MD5

                                                    b29e914e7baa0885e0bbf90d79afb22d

                                                    SHA1

                                                    44945e277bfe81c5816ea9ccc29918ec885108fd

                                                    SHA256

                                                    ea3a1f6dee9d8337e58bcad9ce6a7c8c45fa82e4539c8693210aed0fdf7242aa

                                                    SHA512

                                                    89feea64369e0633c6476a46e6ebafbb4cd4ee586563aed5fdea791095d3eeba57f453425213d49f5e82c51f3e7609c64fa03dde7c799a1aa012e00449a82047

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    019ec53a080185a7e8c78b82786d3c6f

                                                    SHA1

                                                    667726b2158a57f230654fc756c35ccbf4dc1f0b

                                                    SHA256

                                                    75cdcb35b5469d7eab99f82f525c358e35e2edb91c9b7f63073e7371d64559fe

                                                    SHA512

                                                    ec2632dfb1bb39709cbbd21e12bbbe06d08293f1186bb8dac97a84c9449d113d542d3192e038c8e1be2f4d15e464194b016d684973d7232375756891877a7435

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    4KB

                                                    MD5

                                                    88939777d016d654591c3a6b3837ba7c

                                                    SHA1

                                                    20fe748b50ae63354249cc1908acbb8f81f30799

                                                    SHA256

                                                    5585a728b542ebd510367cf687cdc73ad868ee8c063298ae81db46ade5d11a82

                                                    SHA512

                                                    1e8f07f1abfa250388c7f50a49950a0a1e012a0a940721f14a9e78d441ea80daa353eff17424c48e4580f69607a819b9de0321df3991367da7663caaef563327

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    3acb4011f46645ea3c0daf4d6ef9ea1c

                                                    SHA1

                                                    d58c5c7af0a259713afbcec45427dcf571de8cf4

                                                    SHA256

                                                    bd0d6867783ebfa879c76a475844a67f4444b380f4b3913a038ff5cfc12911a7

                                                    SHA512

                                                    eb012826c6fac64604077bc751079c61c756c61f64b5a22e3b7ae623d4625f8f4eb0dd436775176dcd5089ea19dd612ea0df7e58434b30735b4ca23bddd08c47

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    222564e1fd5a2e14474b5e3be33fc375

                                                    SHA1

                                                    ff57dcc1b4749d95e934bde11fd0562e81bd71eb

                                                    SHA256

                                                    34d349c054f5436992abf88a6a005cf6eeb4d71c4db2f3dd3d0fe29a83366827

                                                    SHA512

                                                    c15927e93cb5adcd92a0f08ab45f3f560bcb7a884e4b66b28590b441b61b0df6b55a78e08cc2bfa86eea64e3b646c0cc2b6fbbb9616aacf7874bfa8b7d9210c3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    1eea1c2f924a2d0d9627b0d0b4f6efe9

                                                    SHA1

                                                    9c801bd1288e71c8ae54bbfb36ef92aecab98023

                                                    SHA256

                                                    2d32ce37761cd4c60adf239534dd30bfff124caa86ff01ed6826ad9cd5f317d8

                                                    SHA512

                                                    69d6e69c03acce182a90c8138e64824f1be3a5d79bac014dcdfeb7b799afd302bf91cfcd1ee8975d492d37494b764d7d2f41aaf2d4af253631159eea5985dc00

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    cf8fcf51d2422586000ce6ee267cb111

                                                    SHA1

                                                    bec48ee41febfaa9461d074ee1f71d12c4190729

                                                    SHA256

                                                    3d33001f729fed5e3d055805e3209cb0e2210885d40c37955c72918d52bf6b68

                                                    SHA512

                                                    1c86bee204be8b6e419a7f3bd92e2dbc7b04168c73aab7e7d3e2bc2715a0d21d51ca5c9a3a4fb92a12dc8fa5c555a6ac306a2d66939bc135f5e56601f3dd00c3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    203B

                                                    MD5

                                                    0c637395c112e69183f51d94cfeae760

                                                    SHA1

                                                    e6df33f31690f14a3b520d37011d0c1d67d8768d

                                                    SHA256

                                                    96f0cfd17f3eb0e57cddf8eae3d485ac18df5601fe53ca3769388d488685910a

                                                    SHA512

                                                    33aa71ebf62f941e330d4be7ce2885cc51c2737f33d85d9172962de1045664043508e4f02ee9ccb28fb00c97a60e5565c4647df089e42cfa52347e8e79c21f27

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    872B

                                                    MD5

                                                    217c0a601d0ec0844637d710abba72e5

                                                    SHA1

                                                    561128861b7e41e7093dabf8efa5fff35e63db17

                                                    SHA256

                                                    abbd183595aaa600aea79079a5de3662fec5e2a99831c8aeb49e24ce4d8d9228

                                                    SHA512

                                                    d90c42189e7666208425eb264c5073eb0c55f3c73d679fe0a8b64b22667a4a59a28b6762a54796d62ac284d1b45c20164d1737bc31a53f6c6d01a0fc19be3e7a

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583999.TMP

                                                    Filesize

                                                    203B

                                                    MD5

                                                    02b8c892e0001d92c09333ab80e11318

                                                    SHA1

                                                    0d0a1afe0b8c8e9efc51ca2f9a03178ee6f5be99

                                                    SHA256

                                                    484c6559969ecb98442ed08081583f6dbd4d45e84c02488cc0efd525e8f51055

                                                    SHA512

                                                    da6c456df802562e4bc321ec74bdea8357953cb28bc432ab5802b8c64b7f05457b11b2129d70a3590ec907253af277016c60c149e7d14fce76f65aacb7a4c0c9

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    9c0d0fe8826491fb40f37de0ed8730fd

                                                    SHA1

                                                    e35ee3c8a9497b2705ef39e8a141fde963eb3eb2

                                                    SHA256

                                                    e08420820c77b9f61f2d63e9cf985f380b69ea5dfdc284d9e3ad4357fb6111ff

                                                    SHA512

                                                    3f0778aa49b39cb47e312509a8eef99fede3dad05fbf9c1dc7a3b383c56cea32a2e220ebd0cabe7cff1e8c2bc406d64fdf12d2070508798cd0212c4ad5e44289

                                                  • \??\pipe\LOCAL\crashpad_412_SZSALRDJGINRSNKD

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e