Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
6bd700d447bed03cc172b87b02ff0c45_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bd700d447bed03cc172b87b02ff0c45_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6bd700d447bed03cc172b87b02ff0c45_JaffaCakes118.html
-
Size
129KB
-
MD5
6bd700d447bed03cc172b87b02ff0c45
-
SHA1
c065733fd9c02aacf5ae9c25b879608e358c9215
-
SHA256
b56302e1abf07626790ff7fcb8b3de0830fff663db469005387b4b200c921c84
-
SHA512
cf6021beb0adaf3abf4404922f4521f57ddfe837581330279e7b07128123bd413bb9bef785bc956e0bdc268dda4aca27a5efa4570145c9c525a556a3291cf7aa
-
SSDEEP
3072:vqW3//HGNk2IMQvtwSQS95dOYhxUzPzy7c5ECy411+wXi8SfLLhdyyHgZ:5HxUzPzy7cTyc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1568 msedge.exe 1568 msedge.exe 5796 msedge.exe 5796 msedge.exe 936 identity_helper.exe 936 identity_helper.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5796 wrote to memory of 6084 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 6084 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1140 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1568 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 1568 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe PID 5796 wrote to memory of 5324 5796 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6bd700d447bed03cc172b87b02ff0c45_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d47182⤵PID:6084
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:1140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:82⤵PID:5324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:2080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:5516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:2232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:2968
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:82⤵PID:5588
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:12⤵PID:4092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:12⤵PID:4472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:2552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:12⤵PID:3500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5433742180992138846,859845819276770020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4508 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4472
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3440
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
432B
MD5afa570de4f05215299f9801e46f6823f
SHA1f55af479e138e57d6eeea305e02300063ef3e318
SHA25672bab13536d80725bee4a8765977fcd92659cec4a771ca5237f347d9c0720da1
SHA5129c7d5cee76a2d62b95908244e1b53aab03c6004ef34cfe7c8330479da523f04f0b5098d97da02296d1ffd9776aec171d75357b00c6113c906db3fa6885eb5ddc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
3KB
MD52f4032b23c6fdeea086d879b440a3b1d
SHA1a67187198171eefb8bb866438f667a0e41c62dff
SHA256d80ac8ef67ea479b3b795392aa5834ee9750145ee58d1893d6b0d407152889d1
SHA512eeb33f16f936bfb985798d60e1a0e01c6d0e2809770024c8584879b7243ecb6db2effc7eeaff318125b509bb40af00f4475657f11fe35dc556639b0b0d5f480f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
3KB
MD558bdbd897af922dfe47c8f46dda98235
SHA1d66e1b5726759957e67249974f215a5bb639264a
SHA25655f961191e09a31d767a072055bbbca55319ed66c5298257c0c74cae298d4a9d
SHA512df8604a31c204eb20c3cedb9e7b2f3b4fabb958a6a22390ee873301cdfcfbfd6938ff2f4472adf7132cddd56b32ce2244a27aaa5a57f55c274d5bca3498ac4f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5efaf9759b7e934ce0defc5aa526885dc
SHA1c4e3ac8828424353e80cfbd697f29a0ed03003f4
SHA2569236ab335a2f5f1fc27368f7513eea1676e76509a21e2756d8f51d1eac10b7ae
SHA512e565489356624a5bd36b4dab3ed998c7429e0b647001e11e113aaa95e9d860cfe279d1ec7a48cdc920467e56057b904d373e36c2ab4d802035151ddd8ee64400
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD544f0e5376ab58c8a46891c08b97fee98
SHA1d7fbc095a1a9597de4876bb4a05ab40155df48bf
SHA256af5eae37b1a86c1b420da3f7fcc40ed348b55bf339e8ce6b332398a4e5ebdade
SHA512f8bbd02291909bb10ff364012b256b2261662e437644c6b56c9e584a4455d080b26ee0dee47a679cbecfe09eae5d5e994d0ee66cb5fb302b770789a5012d11fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5f34daf649356bafdc4747f6758f91927
SHA1d75aabd133aec1fc1d643e98dc010aa46b637bcc
SHA2568c9a8eab7d44b514320ab2b620d8857bec296eb6d9aedc73099fa9b57000c92f
SHA5126d9fde8262e979dbb38e23e39d1666881d26a3b8160a4afb57ce8ce697d86d4bc63da6d1fd6266a112545910088386fb8a9a91bee5b13015d7247898afbe4e44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD52ad922f8a9d06d5a07bc29a184e5e612
SHA1cc2aceb575c657d370b2610311798b2b971c2ef4
SHA256dc8ba56de271abc4ad27e6f8b94d129be0ada0849987bf69e374ed03182cd65c
SHA512a909dc14a63dd578ef14b4c39823f8f40603f7b4020c9f03ac3f68062eed6f111a396a6d68a701d83f3bfd8b9042552aa2422b3a6171439674c8b4178184d232
-
\??\pipe\LOCAL\crashpad_5796_PPJMGYTJFSNYAMWEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e