Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-10-2024 13:23

General

  • Target

    6aa83e301b72258f95cbf07b3de1dbce_JaffaCakes118.html

  • Size

    161KB

  • MD5

    6aa83e301b72258f95cbf07b3de1dbce

  • SHA1

    4a21587092111181098310a3031e832afeecf36c

  • SHA256

    5312b2c6cf1d1f486e8d015ea2a39e400bdaab46d59f2e50af2519420777fa55

  • SHA512

    240513417a4f8cddd5546fd1ebdde7749edcf21da63aff58abe17a2ae8d095d7ca5eafc43df9ea35c4fd2468f7dab7755b4018b4685882ab4fb0ed41c5f8d203

  • SSDEEP

    3072:E/3Hv4Uc9qz9g5NXlmoyujm2++g1gTQuH5EK5dfs:hxTe

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6aa83e301b72258f95cbf07b3de1dbce_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8b7646f8,0x7ffa8b764708,0x7ffa8b764718
      2⤵
        PID:4040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:1364
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3260
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
          2⤵
            PID:436
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:4216
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
              2⤵
                PID:3092
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                2⤵
                  PID:4376
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                  2⤵
                    PID:884
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                    2⤵
                      PID:2524
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
                      2⤵
                        PID:2568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
                        2⤵
                          PID:2100
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                          2⤵
                            PID:3000
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
                            2⤵
                              PID:2596
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
                              2⤵
                                PID:332
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
                                2⤵
                                  PID:5192
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
                                  2⤵
                                    PID:868
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:6068
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
                                    2⤵
                                      PID:4768
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
                                      2⤵
                                        PID:5504
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
                                        2⤵
                                          PID:2596
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
                                          2⤵
                                            PID:5280
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17418335658110006361,10714396781251422239,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7028 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5400
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:2144
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:3892

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              6960857d16aadfa79d36df8ebbf0e423

                                              SHA1

                                              e1db43bd478274366621a8c6497e270d46c6ed4f

                                              SHA256

                                              f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

                                              SHA512

                                              6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              f426165d1e5f7df1b7a3758c306cd4ae

                                              SHA1

                                              59ef728fbbb5c4197600f61daec48556fec651c1

                                              SHA256

                                              b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

                                              SHA512

                                              8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                              Filesize

                                              20KB

                                              MD5

                                              05197e9427acea2ac4dc812f97a8f078

                                              SHA1

                                              3d2a38b79da52e57783360f195ac3e7c85edefd8

                                              SHA256

                                              7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

                                              SHA512

                                              084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              96B

                                              MD5

                                              6222bb2065dc0dc8b15378e0216ebce3

                                              SHA1

                                              b3fee64fe02bec192911341047f1f7a338e912bc

                                              SHA256

                                              3916f53c2e448b614bb48c778b42a6993d8b3eeabf2976ce7d6ca15bb8f783d2

                                              SHA512

                                              4b42fd6e1bb39c354a9bfd92ee0fd8ac8b4da021223fb079f01185dd163da8f289450057f11efd23933b6e4d137233272d1e8fd110a4eabd8fcf6b5d9ba59cb5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              408B

                                              MD5

                                              cc21f3d7a20943682019a8cdf965b489

                                              SHA1

                                              0f5a80ec966a3965ffe57deff947226362d46dc2

                                              SHA256

                                              36da156a411c5fd197e49cd54a394cef4ec537c2c90274900af690ef458243f2

                                              SHA512

                                              34fac906ca30fa2f3243e59bc410de6b7f0eff709bdd860e546311ce736ef1345dd8c7441c30721e5d392c85b70e3f98554a5ba7ab9d0d7ce315779bcb3f6afe

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              360B

                                              MD5

                                              028a82502c8bd52c9132e2319e90b26f

                                              SHA1

                                              1b7b081fed5e93c6234226a9e56aff6dbe0f7e06

                                              SHA256

                                              0d7e29582e227ed10903d990fa1cb61d6410cda4e50607da0a0faf3a60edac14

                                              SHA512

                                              04fdf30b2c15d2ccc0007e9afb5cae4cb0a5809b8c99598e2dd3796d452dd06841309f2e436c8415d90531959d878dc1b96a3c0935ac7cd81f6244bc1b13fe0b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              384B

                                              MD5

                                              4d971d24c4115a13b8b46b30c1986038

                                              SHA1

                                              acf27423087d0c27286030630c440b7bfab39255

                                              SHA256

                                              13274d6116d4d818bd5ca72395b85f441ac48a56630ba7a5b1a61b0455ab8a50

                                              SHA512

                                              402cea54c9c41629623c006effa0f0185b84df5ee5d40ef87adcc76264325d563ceb5d3531969a1965a9b5bf7effb71b0c1e350688ef8ae47318efddaa114d3b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              3KB

                                              MD5

                                              1f3dca1ee33a4c958be43ff92a51594c

                                              SHA1

                                              62161975f2f961416034db6290933a53f5f09ad5

                                              SHA256

                                              1120c81c1ff65c189a1cf75abc68bfa7f9e1e76e1da996cac7b5814b5923c987

                                              SHA512

                                              19c9703c4c354cf2dd5ad0410f5bcc70ac090d3ccfd3b4a821d6cba9a7450af83a1a867e8c7b02ffcbd88eb1a7fff0562fb993b99d54c2092b847408ff7db1d7

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              3KB

                                              MD5

                                              55d06c3868257d47d419fb1487f9dc82

                                              SHA1

                                              6d9a158a92866d0e254d2615d0ef6c45e281cafa

                                              SHA256

                                              8a5482f395884a6e3e39847a2b49624fbefdf0789fd99f9ba2e75352adef5dd2

                                              SHA512

                                              0023b0915db574a5aa5ac211272da59f49d6eeeb5cc6fe1bf47228a03858c1a6342619e12cd52e1d0e03b7deddb2573989e564bb52763f65754c39cc44211d14

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              55b3a384d58ed35f27912d5e5b5ca1e3

                                              SHA1

                                              99fb4ae6b6154488d4cd50359f9e94f717678ccb

                                              SHA256

                                              5e6c808dfc4649d4304ac1eb6e21b036e1a6a135d0ea08cbfb37634030269006

                                              SHA512

                                              a32af0c78536b4bf8cca211879c9067be8e2d543d5e8fb0a98bcc3712e4dc59d41659545b80e626ec4f4854fbfcdf21cc33a6e6c9db59f1962439ee165e7653d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              ba49804d49ceb331a5f29a1e06f65bba

                                              SHA1

                                              a5a425dc6db3ed647f8a6fb8abe216f6060b4ec3

                                              SHA256

                                              478ca8c42c166a2849610dfb334c463fb3f738e92bfe7f5b525bbc95bc3ab8f8

                                              SHA512

                                              65912a8e2cd0d36fe5cb729896744ff7eee9299a06b25f8655b0015f337860813add8b0e4f5df7183be6dc6f93c3fc9fcec571d7d64938f5e6e9c81b9f838fbe

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              216ae08b9a8eb429098a1550cf8feac8

                                              SHA1

                                              740fd22fa893d5b6f0dd81bbc0e4fd3c59967e06

                                              SHA256

                                              ee0a1c4407069bd237fad6ae6cb0be8e1a70a7deb65df3c6a8d976fad5ecf557

                                              SHA512

                                              4f91a373334fbc981e27d90e5184b70b759694bb9eb8888258de3638b9b0f5f00dfeeda257ba065f3aa2f82c8b3715c10a252dbd2b06d6d14119007ed8c6d8b5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              8KB

                                              MD5

                                              98aaaadc9c9bc1dbe40f84f3281c30a8

                                              SHA1

                                              1f7a8f928c3d8a60c698a31511a60b27a28627c2

                                              SHA256

                                              a59e3318b3348a8523360e752f80d5549c49cdd585455a0a47f596487c9bbb4d

                                              SHA512

                                              5c4c47370c5c98162264ed93d75fd3a8dbb605a3f6185662765b1ef137b5e5f5714f5bf1c51cfdc5907f3b395aa378404b5ff1a6a79d6efacc343f825c5eef35

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              7aecd1d655acab3b78269eea29a15bc1

                                              SHA1

                                              2515459a16a29d7a16b0f105fab1beaa0c7660aa

                                              SHA256

                                              be066c72b436cf4f64360abed413ddf6d0939e813d9cf495ffe89c4384b6828d

                                              SHA512

                                              1bc1c3832631a50149a259e98c16f0e3aa3bb4e01ae19c39fcd3630d36b405c1b82f45aaaf7ea818a411a3264e30da11d4ca67b297befac32351d67d6081d9a0

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              c58425a0a33e68c6c1a52fa8325c7f8a

                                              SHA1

                                              45c666d71ca6b99e5a77f22c62ad0b383089cfeb

                                              SHA256

                                              520c684cfd6038ff7bf038930f57a48caa1c02307df1bb28aafa1306a584babc

                                              SHA512

                                              67a319ec235d17755e3fb641d4615daca987343ed4473e37ca94b76768edf11819501875c0e9c8aeb7d632c8d89e6aa19b2a129f4004f32a9f7e5177d5c75500

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58247b.TMP

                                              Filesize

                                              705B

                                              MD5

                                              9d850618681b21b0606d2bea8808962a

                                              SHA1

                                              0e8b199c573dc313cd36b420cdb5e0b8d6413b80

                                              SHA256

                                              8ec0ccea40031c8f79f28517be5565ab5eb77b297e8eb4eef437306a4d340941

                                              SHA512

                                              b5efccbf0023a216ad8877d89bc30c15c7e02675f648bb278e9a79bf0d433fdfc9467156c2631b75edada7f9a79bac27819d55915fc3690903029c5c623ce97f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              2cf810f7ebaf2bf758d1b98dc98c7d9e

                                              SHA1

                                              7b605449d5e5525ba4758bcf688b9f14e510d651

                                              SHA256

                                              11eb6957a3976d9a8e9e83c018b53180ac6ceeadfffea11f3479096ee7d4d54c

                                              SHA512

                                              e47b994080c6e504322bad501cf54dca10c50dc5367adfd5a45b86e6141a0094e0b1e590e8b86a3c99e04a6de3cad56f4912556ddb180aa45bd7b01ebfb5d908

                                            • \??\pipe\LOCAL\crashpad_4420_DCKBZNDRFZJGHSZK

                                              MD5

                                              d41d8cd98f00b204e9800998ecf8427e

                                              SHA1

                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                              SHA256

                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                              SHA512

                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e