Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
6bd7364fcf82f218639b6632392ca954_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bd7364fcf82f218639b6632392ca954_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6bd7364fcf82f218639b6632392ca954_JaffaCakes118.html
-
Size
58KB
-
MD5
6bd7364fcf82f218639b6632392ca954
-
SHA1
fc064d86fb76181854f57afde6a58edf2300a246
-
SHA256
422d6853b9cef94f766a1ae3b25a3ea6823e3d24a186fb13a078e86fee759b41
-
SHA512
14d19be2ff58fd2615d694ac6441f6286468dc09d82db0308a930b7c8f1f1c747184ca65341cb381db3df9bc85b635a4bb8d18b73cd2152544a74a3e7f6a3b6f
-
SSDEEP
768:mRdxqT61DKpB3gGN5AVxpDNgi4eiqFwc21/ag4TsKMl129drHzi:mRdxq4KpB3T5AVxpDNgHei8289MlarTi
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2592 msedge.exe 2592 msedge.exe 3424 msedge.exe 3424 msedge.exe 3020 identity_helper.exe 3020 identity_helper.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3424 wrote to memory of 1852 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 1852 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 4416 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2592 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2592 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe PID 3424 wrote to memory of 2052 3424 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6bd7364fcf82f218639b6632392ca954_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb166d46f8,0x7ffb166d4708,0x7ffb166d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,234759360860254862,9224405188705367209,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000bFilesize
40KB
MD55ce7bdeeea547dc5e395554f1de0b179
SHA13dba53fa4da7c828a468d17abc09b265b664078a
SHA256675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9
SHA5120bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD509e14d60c4a94acc57cb87723ace2633
SHA1a2167a3351d0430c5034d8b0690e4379e7d1fe04
SHA256c93cb460b768c09da4325413bfd8fb047a3857f4c642cede9f18fc39fb75da60
SHA51258cb93a6bc700875de3319801777a9dc7ccdc303165d15dff46d411d6fd077f0245874ed6a89d276b1627df5707f3c88bdef06dd2633c1a4d39b98874fca696e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD513b9e3cda254235faebdac180104130a
SHA114a6ff403a68de09e93cf479233681b3def26c6a
SHA256121d6c927ee005d3a2ea26a39ec02659a2366c1af313fb0aa62238bbd8fbe38d
SHA5126de9e754399d77cf69e4313e117ecb32ff128fc3163c2f9f22476e4f035461093b7a597951d7ad7abba65f8e619ee91a18be3c4e0dba6662bf5d7a3c25834d55
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5533a73fb34965dbe6f87319e1e518764
SHA18259831ebec9f7ee1e94e4e147782ebd787413b3
SHA25628286ae25b4b14bc2324daa454a161baf22679cef81155d3d66fa24ddf98ffb4
SHA512efdd322ae5754859340a3b50e903a8dbad058c95bcdc86a90528e798f0fe5637c02c92ff3cb6403d185a094fa399629f2fa70da4def17fe7fe36230bfe2917e4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5765d10982e27024c15d41dcb64406920
SHA1236a55d8476e109f0848e7836e4a229d6d30e6af
SHA25631920d156c3291bdcf4f2cfdef3fe54190d1dd1049af9aca7eac27edbe7c3219
SHA5123c63585cd8e7e36cd3261ea7e3a3aefce444f16fee08dcdece35e577d14a82a5b12bde6e0cb4ad3801b720444d7735221e727839703d63f7025f69481e2f52f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52eeda988c328e3ae42e0e09d3a8cf8c1
SHA1af8d92451d92aa47bf24b34ca1ad9ae45dc18a63
SHA25633a93752414ff2c5729443603d15faef31f8ebcaedbff46063a9b65c1d320194
SHA51297c40083ba01ce99dce874e1f72c37abb015102457e6266987313eb60edf5b7d2416a65064fdd05d1b590fa531f7cabffb2e3b5e03667033cff6bf780d4fbef0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD54127a3e58e03e43b826cedad588d1176
SHA19f0427210ec58d9bf90fb4f7f4028e52dc0bfe82
SHA256df38ce727cfeb029f81218c29c3fdd79c5d415c180dad69484d99f56ec47a2f9
SHA5128fd27f71abca53e84c587cc1879bfe862f4c7c5653acbb1d6edde4182971a507d3f88c2fe716ee0dc35c4be1d13c93ab4e359b87bbf1a6dcad31d36f27563689
-
\??\pipe\LOCAL\crashpad_3424_RUIOWYBRGMZLDGYIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e