Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:17
Static task
static1
Behavioral task
behavioral1
Sample
03c00378f304f3379569ad7ce9b500a8_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
03c00378f304f3379569ad7ce9b500a8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
03c00378f304f3379569ad7ce9b500a8_JaffaCakes118.html
-
Size
58KB
-
MD5
03c00378f304f3379569ad7ce9b500a8
-
SHA1
d34809775276ab7ab83b4bfe7e1d26e4fba98736
-
SHA256
ae5c65489a0886ecf0b860568ea957b83a62dcba58ad508b885b619edb3ab47a
-
SHA512
dec85fefd1d744bda0b45b5038dabda301678e5e3ecd4da8a4ecad8c35197bcc414a76f347f33eeeb612805c898747780f5fe6d7e660b833e4e0b3b522ebcf8a
-
SSDEEP
1536:JPMfrh2e+bymfBv8F8yKETvnVeMfOfsw9IW3JAN9+WT6XJJe90n3Jv9LW0JG9ZWm:Krh2JbympvQVnfB16bW8sf7PhS1F5q4m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1132 msedge.exe 1132 msedge.exe 220 msedge.exe 220 msedge.exe 3180 identity_helper.exe 3180 identity_helper.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 220 wrote to memory of 880 220 msedge.exe msedge.exe PID 220 wrote to memory of 880 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 2752 220 msedge.exe msedge.exe PID 220 wrote to memory of 1132 220 msedge.exe msedge.exe PID 220 wrote to memory of 1132 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe PID 220 wrote to memory of 2696 220 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c00378f304f3379569ad7ce9b500a8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e7047182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10013002687930705492,10281940773374551035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3172 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD5477e0c6a9fa35976fc51bba081a97475
SHA1b1e33fc0837ee1485e7ccd49c9c17ebd312ac125
SHA25609c9e217404aa556876a430064b21d9dd7170dbff76aea9b3101ba22dec1b702
SHA512e76aa56093eb7a9147028f17830fe64d05f0bdef3bc3961837962b33cc9f9adaae3d2c2c5f86092891ba7459fe6960f13780f5d6c669615e11bda6d4dba8413e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD554ff3bc4900948e81e0460ecedc591ec
SHA1e76ea49704f1996262d0cbd7bbd67059af5e0308
SHA25612b45cd3b5cfe07d620a16d4b874c9a628493834c6e6e06202df5c41515d1f76
SHA512bd13ea75bd64f9ab5b59f365d05de27b63c2f68cb68a06a75a7f8dbbdf7179a6659db0fd29dca8b7b5aa195474619044f397fc230306fe0da1b09141d0a9b47a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD58991a032568418e338fe725f3f4c0cb6
SHA1b47cb9ceceb6d8a8a6238438c15b0ecc0939e0c9
SHA256613844297fd4c3360b1c75d394b862dc6446b4c07e28f822c5bf9aafcfdd1636
SHA51217723fa63f4c9f8fe52715f1a2ae326c8a1c0b6e7836b797392ee28daf2b06a1c11a019616006e37c58f2ef4d604582be015e8b5f6b3a4f569cedc849c455db3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53fddf58337ca664f6ca2804df9b35c5e
SHA19073e70237515be95821470a24a378a7685510b0
SHA25696e14bc5f8ff231c441e8592a4ad87e6a7381c3c199ac4a3021cfea689ae61fa
SHA512e620c60c2d91e006456c2fc736eab6ecfeb2a94ae96cd885dc5928ed4551ce947f4af2b50c98ef2143f1c3bec1720266bce226e53de761ea89578e6e29aae50a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5847a84127c20f8e251c7de3f1bb3ebc1
SHA1f4fd11e2cc9c03a01e9888d36476a12d1485276c
SHA256019291e06f160cae4e01f0726316e7e8fdcfe3135737cd9e3f1bf5d1776328e4
SHA5123acc6d78ee26a3d09bb418ba623be4558ac8ee2cae77d9435f9d56d868e37c27d4de201607ee7d53f0b90cadb0b4833d17f3bd31e80b690e2bde4e3151aed1dc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e62968d62f350fdaff4c10585be9d981
SHA1dbd01ad055176307a0a5f1fc798bfad9b90d031a
SHA2568058569bcb730ecca4ce50c97eb26e661160c50aafa82bf43954235ec34a7298
SHA512efab068148ffaf7b9f79b0c4157abc9da555873260270c4c75529822d43cde9ffbae6fd44ef17a8c8871a1a29a37cd184678e3cc7357a78b46e292c0bb5fe7b9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56fb3e36a5df12d397d982bc7eceee493
SHA179478f53305851c509a0b92f9fa7e862497b699c
SHA256de67c98b2c190c6464a45d6f337a7c6b8b9413ccca763768e1fd5e8371f08864
SHA512750ac2908a2e8fdb73f20e28c633b1c7db5ed94f68f92d0973d62c65c1e378a62fe8c6feb7f9d9794ffdae88fe2281f7fbb66656de295059aad0c6a37c6e3764
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
873B
MD5a0ecf72118abddcdd6a4ad6630ffa9af
SHA1956e17a7f543235d92d7aa3ebb912ebd0695cd9d
SHA256b9308e8a68da5c0ff7f45120efac7732c4e84e57ee0fcb4cab83b57e4df914d9
SHA512f40a5d15aedbaf34f8e1156b843157ae47ac7a6ddbd9b949008a03d8606e9184ddce5873f672b85b50c5893679d91c28fdef8394e9c1721958382bb7e72ccf5f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb2f.TMPFilesize
539B
MD54491589e879acf06bc64956910722d72
SHA1e07322365ad3fd686b834ad8beafc71548a65ee6
SHA256fa5de188edfb0a42daaecc43bfdc8bedad35e8f5f4824f2d8f75b8a5eb86369d
SHA512c620ebf53244b56444b9f202bc48b294d2f221f125eaa66d9d445fc15e8d53276d7edb9a36f6103a5795d7d882e36f19737ca74bfcb346efb8bc26edfd590720
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD56907633498622f4e86ad4edc6b17c930
SHA1cadc55353d77e5f955c3dc2089603b62083534e4
SHA256ffa2cff71c840129913457fe6a40705df0894df04557c55f5b6c2593a1af57c7
SHA51272919b9e3a723c25bb1d318c78d562fe26510988be98cbab0aac3d2db814f5114cb861bdff3d56efd49f5843235e9df7a7fc7f866b9c707e9865cf0e757d8f52
-
\??\pipe\LOCAL\crashpad_220_JZXKGCFUJSLPSFDFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e