Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:40
Static task
static1
Behavioral task
behavioral1
Sample
68ba1387160554c6546113c871b0b238_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
68ba1387160554c6546113c871b0b238_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68ba1387160554c6546113c871b0b238_JaffaCakes118.html
-
Size
175KB
-
MD5
68ba1387160554c6546113c871b0b238
-
SHA1
1d6bac4ed384f08451a9fc5d78926286cfa2dc05
-
SHA256
822893bca423e4bba4f0a9a2a6a945a1f16fc0050134a8468771add36d44ccdb
-
SHA512
71c3b601e36cb0d6ee6043f493a4cb8271ff49e0ac3a23c2a3491b81b2e53981062d1a43e69894eb819312c7326a2d4590caef1af69395b79c192021c5a915cc
-
SSDEEP
1536:Sqtj8hd8Wu8pI8Cd8hd8dQg0H//3oS32GNkF/YfBCJisX+aeTH+WK/Lf1/hmnVSV:SSoT32/FeBCJiPm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1788 msedge.exe 1788 msedge.exe 2916 msedge.exe 2916 msedge.exe 2360 identity_helper.exe 2360 identity_helper.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2916 wrote to memory of 3180 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3180 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 4880 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1788 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1788 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 3356 2916 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68ba1387160554c6546113c871b0b238_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9da146f8,0x7ffb9da14708,0x7ffb9da147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,284535969447868401,5378230244634793540,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
408B
MD5cbc3147dff1ab6813e243235c51ff74c
SHA1cf855009c575022bc38b4337e1ade759b7de6dd6
SHA2568529ffa77debc3cc95ce9fa5af5e11ee906122043f9f1cd735ce10444a656c7d
SHA512de907fb3d433ebcd89496daf6ccbad39aefe26596e47cab69ef980628a879cac49875821fe7329fc1301775f3bce20cec6df63b33237a1e0ab488fca355aef87
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5988e578c8445a37188d04414ba257d03
SHA1b7b6e0a0db1e7c66b73550eb2f69310b51764216
SHA25617a505b2127d28330c1a28b27933884cd474587069713cefd03bf7d3dbc5d9be
SHA512cc3265a667cc4031e9f9a6b99081d20416de9a382066541439a1a208c821967f4e8282846d1b14fd3ce44460205bb4c508cd9bc1f3cc7b93383840259e4a83b3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD55a275e1f78ac91e40c49b5bf33d78560
SHA1ac5b677f28bac2adf42c061b9656bcafaecef62b
SHA256c6cc12c6cea16e2dca22c125a611408aa237c1f6669fcdbcbf5d43eb0f263342
SHA512987466f2f85b4d27cab24046975ef7ca5fbee5ee6de6bba7977914f9083629600b7486baf51e9ef5e216535cd3fa59609c2e6b807d80dcfc28c0c35a3e093a1a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD587926ca29138587b0579a1523654ce96
SHA16f983b123837a286c20438ae563179974b3121a0
SHA256b3a8159021858fbdc9eecc40155129021d8a9ab8ce730c66af63f7aaa630ed08
SHA5127a63a6d9922635295b55d5ee956bc35433d323bb5551d92f75125b79b9d1bda3f9c54e6ab24138089ed69809a96d85bf6b255d3defc7f130f4abad50aed2e45b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD57c2116b6494e6c2f62e8cb458ad629a9
SHA1521c354d24e4a98b895849a058918657f57dffd3
SHA256f20b96efa712f988fcc122d32b8139f530bdb9820f657ecfb374f5b8223d870a
SHA51262bf9ea945a7a575eac3b6650b491c989ec8d225f3a1a60712eabd4fd722d5a949516678fc2221f243fccd3686b091fa0fe7a6f4cac63241e6f353429e3ad744
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD54e6c5a093cc6c4072d39db2379f69a7e
SHA1275aef5dd73392d06c4970ff51f7f4293384a68c
SHA2566897b4086585ce7ba00ac8d0695a57f1b8d06494f32c8eb7dc5672699ff8f78c
SHA512261a51243b967abf97fffd659ede4f066f7f8554c9c99f57c957af98be4429d6b3b0a715f181a53cd6784b71aa40829857fa2cd34b0e323f09d9fcb149360a58
-
\??\pipe\LOCAL\crashpad_2916_AYXIZHTLHYMOHZQPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e