Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
6970816fb1aaa6a52d035b83a6eb3f01_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6970816fb1aaa6a52d035b83a6eb3f01_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6970816fb1aaa6a52d035b83a6eb3f01_JaffaCakes118.html
-
Size
30KB
-
MD5
6970816fb1aaa6a52d035b83a6eb3f01
-
SHA1
e2eecd6c319683ab6231842d45a623474c7cc58d
-
SHA256
592c55283cab89ae1c7b7df7043d5b8f45ddb9a487799b27103665dd5f86b9c9
-
SHA512
ec30166a59359ba841fcfab750ce2e2111f583a518a94b6910fe80d4e2f800235e1653dc7db88f3d9c705d53dec7e0efd037f283a26353e2cfc0cc25ca582a29
-
SSDEEP
384:WBqtZRsVuEc+64kuOENbRul0LgIssbQbDwiTkBFV1aG/a1B7rl9xpp5pWNkUOZ:TtZRsV2+64kPENbRJZYDN4n+Gy1JlS2Z
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1576 msedge.exe 1576 msedge.exe 4724 msedge.exe 4724 msedge.exe 2828 identity_helper.exe 2828 identity_helper.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4724 wrote to memory of 3252 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 3252 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 1576 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 1576 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4772 4724 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6970816fb1aaa6a52d035b83a6eb3f01_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1315419845916112116,17236799130600461701,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2580 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
96B
MD5d895d63c657b5560ab67608b3053812b
SHA15c3b33d1015d0e933413030e1d312c6c4e23e758
SHA2566ba3b8224467682e2cccbcce5b05b249572ea748c378ecd4a7705446b6be9ec5
SHA512a0f94ade8d3c7217ecd065e0aed246cdc93c661c6130db9ddb22491d2173d17344587cd02e8715ad845994ec8c13ab078659b14cda6e92883fe2c1ff84d2f3bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
811B
MD57bc5dc1bb0c4ebba3f4a1ca73582caa8
SHA13616b6f0175df1c4e8b0cd1e122c99452a51bb92
SHA2569174b1577f7fa05e0a8dfdcda077bf841d0f3c36de1937beb305c7c84eb7bb6c
SHA512b5e4f886eea814eab09ad9597c2140d3dc9528683e84282f3a3777ff7e4625e193df0dcf921b773a623d9f2f8e1838c35e9ff47b8bcc80f39546be80dbcaf3cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5db86cc1cf658b8ebcbf03865327a204b
SHA1bbbe785ea1cbfde2ebfd757f4ecf2e72b8a7347e
SHA2563eea2ff0f92fb74cb6047297d368262f8af1c7872571e86026ea95c8031242b6
SHA5124062e5f33e2b5eccb32176f5fe774650ac2c900fa0249f1076318496bce3f35528a1727d5f1548863a2954fb091e86efa00f9e64089ac76b428a36167a862251
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD566cf70ac423618457525b36f15b2ecaa
SHA18cbb0ac49d520c86a0d8556bf6024be7a88c165b
SHA2566a866a3ef03b0165be46d0f440ebc1cf93f4e489da8ee5817649275a3f641b9f
SHA512b2c66b15efbf092487f469074d83901a12e8e0bb00811625274ed297caadf2f16d48aae970cc8d18edeb1508110dcfbf887d09a336034a2bfbf0e1c62bd4dc58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50189fefb650ea35651e76b8c2f845268
SHA199733cfa59b7515973550ee34875799f40199245
SHA256e11b3b1cf9c4cacd27fe3ffee7abb651748f0bb7905e08ef5b2f1ad5aafd6994
SHA512cb980e72a4a52effd2f664cd678ec360cd3dad5f1c4b36f037c246983deef0fa9bb5fd092513fe8aebf76d512f2e9db13215aaf21eb7a97f414caaf59d9d615b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5055eca9c0f7f79974e1b5b3543f4cd54
SHA1500ffa6b9e0716d7004aa3bc41c772ceaa21bf00
SHA256208245e8002b32d4757d891f8bbb4c2bb85b1d8c394aceb4527360b822931d8c
SHA512f811796bfec94cac87ab10cbaabd4a99e665f4cbff9bc7e768c3c991058904c4ea61f907f401dd3573797e8eda3008e49bc4f82b17efff1c88497cee14b192cb
-
\??\pipe\LOCAL\crashpad_4724_ZMZDVWRZGYYIYIBYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e