Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:13
Static task
static1
Behavioral task
behavioral1
Sample
03bdf80a2eb5b6ec1a5c098cd586da08_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
03bdf80a2eb5b6ec1a5c098cd586da08_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
03bdf80a2eb5b6ec1a5c098cd586da08_JaffaCakes118.html
-
Size
93KB
-
MD5
03bdf80a2eb5b6ec1a5c098cd586da08
-
SHA1
2f994232419d5905ffd1cf0ac997206e10224ad4
-
SHA256
81b4577b4cb9f62396580a0eef8d4b4cc8596bde950fae4df07595260368a0f9
-
SHA512
dd388fd47a9010320c264b81ab9e5593d12299e6743981e060b9602b0c624665910263a3bf4d69b3db831d2f377385333aa68af4c5b5e7d433088c59f2ddac62
-
SSDEEP
768:W1lkvgOriWNzvoWgGZLZOo3OMlSIBz4ScHyjQ3+5+I9ipSkP08jq29GQ:W8vDLZvOMl9zcHZU+IP18jH
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3108 msedge.exe 3108 msedge.exe 5108 msedge.exe 5108 msedge.exe 3292 identity_helper.exe 3292 identity_helper.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5108 wrote to memory of 1136 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1136 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 4648 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 3108 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 3108 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe PID 5108 wrote to memory of 1260 5108 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03bdf80a2eb5b6ec1a5c098cd586da08_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb93f46f8,0x7ffcb93f4708,0x7ffcb93f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,6915665041425306282,18309564811819779201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010Filesize
44KB
MD588477d32f888c2b8a3f3d98deb460b3d
SHA11fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA2561b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
SHA512e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012Filesize
20KB
MD5b6c8122025aff891940d1d5e1ab95fce
SHA1a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA2569954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
SHA512e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD5dd7c1b84aed31b0977e34a203507966d
SHA1418491547c1de44eaaf4d18f78acf049dc6dd644
SHA256b4676e8824282ec3253751a3723d6d67e521285a8c09248616d13aa1c20e9078
SHA5129349e1ea2d3d0a5a7a42e608d50b70f0693ebc00913ccd4d43610edc8eea5dd49530d32ac7736480e3f52d01d8376b0dfea5c2d1034ba4aa6cbfc4fa6bf94afa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD55acb57bb52a1300e6aa0278f07c7a358
SHA108f6ca4774981fb824e11ea7a022a8f87aec1301
SHA256ca412b0d64a26ba6a2cf3652f7c32c1be1406973beb849b9aea336993f14a7a4
SHA512462f768aa834fbff3e0200f203d9b0883741ce454804620a3615103b77f9c2a6bc464c2b20966b30e1c46c0e68b1927c3e4498df4f2c8b8d61276d40f78e7d98
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD535244dccb238491dba10e3eede068281
SHA18493d12342749686a375e6788c486d8b3a2ed713
SHA25681bfe49d63d7257177750bdb954e27af075079dbdffafd776e4586f4a19bee22
SHA5125ec97336970b2be00cb62e2186e6cecacd6ddf1c7444244045abe044b99b46e6e71ae1c1970ab097d67d5216c1f57d9c67c204d4c1975a7594e970f235fcba6f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5ececb505ddeef61adb09d9ffc82d91ba
SHA177500f49a05222f989faf02488a47fe99b23edda
SHA256f4e1626cf59df69ea6561a55c702c3eb1523d407b3405b7778de6b5bc064d9bf
SHA512fbae0c64635000868f20addd49313668c6013a8251664c98696b3ee8d5a3412490cde3ab573d5e71e78a864389eb40472f946e1e4b7d6f5390163197f5bfa1b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52da90958d2ab6fd27007abe760b5dbc2
SHA1bca69e16a163276787719ce3ea4db9dd750df144
SHA256159759137654445a4fcbaa488efba04066022ab97eb5e1a6cc2dbf16189b4729
SHA512661609762b9f6dbc8f15249ae494bbb16586387575ef1c2b3a88bf42dda6113b9d3094391d2f14f469b49f042b54454219a1f320055493fd6edada5e3faa143b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5c1f300889f1ab426baf96904e1479897
SHA14c4b29d07fc72821fc6d57c4d85addcc0519b738
SHA25679a32dbc7bffa2344d9cf7b1758fbd38224f0999cc51f0d89a3f6c6aaf4ee688
SHA512da9ba4926c207770886feace34158087ba99447fa78c35ff86a617cc2d1d1985beb94acdcf82d5dc560d32264e7164033fb54964ca03daa8e5ce8bf9d2c9e847
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5a4227ff7b4319456955ac8a648d47524
SHA19e13c2ad7b3d18e867bf592d143b74e84ed0789f
SHA256a5156fa7778d81aca4a4ef6beb1ae9a8d0853c5b8d23c68a00ea12ce7d23f7ea
SHA5129aa219952aac96feb97247c94ab2773b813d060c78296c6b1ec0b7a2b08ef9e4441f2fae697d4bb1d23488688a9a219dd065446065dd969398903ea37da28b5a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5f1e6a2290bbe3e2971942cccd6bc2cb3
SHA15ae0ef976fe3d9cf76703747446b951458017656
SHA2566d89567de2bb2b42a6a7830aa4eb7988c592efbe2c25040e63a0bd56774a0105
SHA512b34f3d2ee64850bd93f8668ee087eef6946f6c84b6ada6a43b109dd16b313ba9c8b320cf31c2c82119b450b22a79f4a97ad3f8c03ee3249a54ef099978ea66af
-
\??\pipe\LOCAL\crashpad_5108_QXOIXNCVYHGXGLPJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e