Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:16
Static task
static1
Behavioral task
behavioral1
Sample
65d2beb0025a90051c653f00f9414d01_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65d2beb0025a90051c653f00f9414d01_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65d2beb0025a90051c653f00f9414d01_JaffaCakes118.html
-
Size
30KB
-
MD5
65d2beb0025a90051c653f00f9414d01
-
SHA1
680cf1c1c046fa3cd5ab19926714187344408667
-
SHA256
bd484575103462e9ba59745a0f52dc4d9ca4c247048c10697dac251ebe8f497b
-
SHA512
88ad2a20023e43f4f3cd24c6bcf71bce68ab32946d35c18258bde7f307ce99a7fe96b38327d5fa3b32c54fb22ba1a7a18ba7951348d9d8634b2ab1653ee849af
-
SSDEEP
384:5crNdRDm5LiuWQ9j0/end6pp3+eZTOVHwpefQsuUXAJWK6MSpOFN:kgidQ9j02d6eeSHXfZbAJJ6MSpgN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3676 msedge.exe 3676 msedge.exe 2524 msedge.exe 2524 msedge.exe 1644 identity_helper.exe 1644 identity_helper.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2524 wrote to memory of 536 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 536 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3656 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3676 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 3676 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4040 2524 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d2beb0025a90051c653f00f9414d01_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8a9846f8,0x7ffb8a984708,0x7ffb8a9847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14868133374097558535,3083124641286884582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD5ee84c7c4212582b495e18e72fb0138d0
SHA138d94c215fd4754ef41930bd129bc6966e41b8c6
SHA256c34f556934944f4fe31734ae0e7a9b434d5c328f49491bc7f52ce24afaf6b0a8
SHA5128acca3ba82a3e45f0db2e7f660e2eca0fae5f997d146989bed2115a62427421b61c2fe9d84acf11114d009414165fe3430b219a70717a9774086a8e3b68636dc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5a046bc190abd1f1035e2c8c8c7f8c91d
SHA135c55be28f3c72eaf741fe8b5c4908ce810d1811
SHA25629335b3c993f6a8372f9d1c007174bf592c283d7ad1497b825888412992ca62f
SHA51261b006a0ff5815bbf9da123c33897d30b55adb0a2167b596da1142ed3f8abd00ecd5cee00d6f731afe6c2f3f3ed0a86e2ebc56e0a3970bbef818fdab8aaa94cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD53f4fb08305ef2a35985b6b579549aaf7
SHA1f8f2c406abe6e558e7fff43ef65d0b23d327f0f8
SHA256c4adae5992a1ebb82d720475d27b600326e3c3df8fb4bc09062279f58611973d
SHA5120b9e36c27920207e61ea3da56831faea32ed9443c3e0969d5947cac2f13a0ccab548d30f9db2c2174ac845a02e97fe927fc3dd8ae1c01bbf659f735b15b76423
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56df5c795c77f5bbed9ed8a080c3d0075
SHA1d40c5754ce7cfa4fdc9e0d36edcb7c8cb0dc22b2
SHA2568dd4cb20db0c53eeb12af9dec87fb77c17f875488207a26b5235998b6823bef0
SHA51234332e60191bb2431483f1ba8d5adf88dee51d508b06d446b5d67ec9944f49c230fde640a893ae9daaccf20a3cc67c1c9f413869c58c4e31bcbcfff883609f72
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57f377f78738eadc50745b81aa98ed861
SHA13d7ae0cdf413de87c3c41ee2d9cf6d8b16d3b71b
SHA2562a91b0c25d63a13d56cc98fb46b027c041d3d9187ad430a602bd38da243aa7a3
SHA512910e3572f879f2dc368b0ff6a8ac6450e88d227c4751a03be5ed735aa3c1a050668c556f9a9482e872e7ff9b4745e0ab7550130bc01034dc9b68a50f52ca92ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
540B
MD5868e2e584e28bc92d0c2752ae8e7e3bd
SHA16f53fbe827473211753824acd278a6c998ab3f29
SHA256c9742818e2bf76dd2f5518e5053d849a428e88a8ce107fa2d9fbab19f38d9e5c
SHA512b4a41025473cc8a2caffbe3c8031d1d64d77821b72cdd16fe501c209e2ba36fe3b6125a31bb2aa7a08c4cfade954e497b1829c76c152a9bce2cd509f9d196c9a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d7e1.TMPFilesize
540B
MD5d8c50ccc563dc67b984462d8e49fad81
SHA17408a3b6a2b454378ab27731b5d0a2f1d47f44ee
SHA25631ca850bf1ebdc3809d97b0359086f24925bb6a2997729c7f6606582641a0778
SHA512b3fd1816c233852b06fe44e2571540b3fe23f26cea81938394261c2f3ecdeeafa41e2130f6afc3fee628c40352c8f787bb2488fe7d5d05841e8f0e6348fb5dda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD53d3eb3717ae053cc7cb8c661a585a9a4
SHA17ea7e22ce0e9bc00f1a7e310fe88a211ad79af93
SHA25613d6a50df9778009c12b7f22e8ae5c3f2ff26336df5322ed1dbb2f6d166bc5ad
SHA512f1d4d0b103d54311d812fe7c1d4f787e746cd649d6cfff6b05fc30f851a1feb5702645c0463d2b4f64afa56660636e173d4b6f0e94235471a0a991f0ab101e51
-
\??\pipe\LOCAL\crashpad_2524_ZVPPFPCJANSRYFMLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e