Analysis
-
max time kernel
17s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 14:14
Static task
static1
Behavioral task
behavioral1
Sample
new.exe
Resource
win7-20230220-en
General
-
Target
new.exe
-
Size
696KB
-
MD5
02303380d5f02e5e200458d4da0c0885
-
SHA1
bae5856c2e92e07be4b58d1cb7cd9cbaf0497d3d
-
SHA256
baeebf08fff879397dff870611a145b0c4faef973b3f676c259ae87c24e26175
-
SHA512
c654835ef51f70a75d1bb4942e601d6cb78748d00861155429ffa5444566c2799cf0555ee2eb96d0dd3de0aff8e4af2742d4beecc85e3ade8e9c20a3c59c5e9d
-
SSDEEP
12288:MpYI2DkndsZu70GzSslDsXQBIAOKOQJdS6Nd0NjpUkoF4eVg1a:MPdsA7ZAX3AZOq9Ndsjiq1a
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 4176 msedge.exe 4176 msedge.exe 388 msedge.exe 388 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 388 msedge.exe 388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
new.exemsedge.exedescription pid process target process PID 1732 wrote to memory of 388 1732 new.exe msedge.exe PID 1732 wrote to memory of 388 1732 new.exe msedge.exe PID 388 wrote to memory of 412 388 msedge.exe msedge.exe PID 388 wrote to memory of 412 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 968 388 msedge.exe msedge.exe PID 388 wrote to memory of 4176 388 msedge.exe msedge.exe PID 388 wrote to memory of 4176 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe PID 388 wrote to memory of 2132 388 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new.exe"C:\Users\Admin\AppData\Local\Temp\new.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=new.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe04de46f8,0x7ffe04de4708,0x7ffe04de47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7f4765460,0x7ff7f4765470,0x7ff7f47654804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5646133748389809785,15104891609106495445,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=new.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe04de46f8,0x7ffe04de4708,0x7ffe04de47183⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5462f3c1360a4b5e319363930bc4806f6
SHA19ba5e43d833c284b89519423f6b6dab5a859a8d0
SHA256fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85
SHA5125584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d2642245b1e4572ba7d7cd13a0675bb8
SHA196456510884685146d3fa2e19202fd2035d64833
SHA2563763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1
SHA51299e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50faeb8169ab57fcbacca51bfd5e91364
SHA1d99ed3fb566615b5f94ee298ace27fa374befed8
SHA256affc8a7ab217b8983ae59d2a59278cc8886fb3fd79511cd0c7b99c4a1d6b5110
SHA51207160468cc3ae9c6db31b991e47e2e75efd132e594d50234360e342628174e8fff759d0e1bb9460a63bec61e0c3bcda87a8ca3c36fae9155553423c68c402984
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5ea7a40f0c929dd98f4c5e43053b73b1a
SHA165c7d24002c2a8cd1fe3dc46718849b7d3cfedfd
SHA25670769c8f68e784755271d171fd8a2b567c7074a89e780dfa956529708893c2dc
SHA512ea1261947b33125be755d12d67453e5b872f4388cd97bd31a6aa49adda01a47ceaa56a68f73137f4e95adce83041b2df5401194f0abdcce08f9d2a5d0825bb2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5162d7f0066e2296704c0bd9b209e90ee
SHA1a77895c8ab95e0b8fc86ef357d7fcad2afb386b6
SHA2563d4ff4eb1b6cd03318e5f7fe2f0ecb77d3f4253dde5267d0eceb948a13e48c19
SHA5122f58d294d3c6fa289a39ff7a0e56bee71451bbf1cd1a83567d25caf065ac8a60ee73aead4eba09455be9ef2a04a57ee4e9c8ecab486e9c4e6552a30d515c003e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD543c797e61353ee7c5d6b304b00958357
SHA1f91cbbd68544fc0b6eae761f7d6339256eca6572
SHA2569ccef20139976b1852b2f42d532bdf5942bc068958455b57cada83a969098f9c
SHA5122af8d22babc91b912191d5b86d9aa3e2f1c57a00ab3f748aa785457f83c618444b8f0fdda49b0a6613d21236b0a74265231a42cebc9673b40776e2d47ff877ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5130644a5f79b27202a13879460f2c31a
SHA129e213847a017531e849139c7449bce6b39cb2fa
SHA2561306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1
SHA512fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5aab807ccace86cc6739689adb46bbfd2
SHA17b335340cc8223af078f19668ef5140921026683
SHA256f6c1c14bd9b5d237ec9a426e1f42d4fcdfb6f99fac8fe27251a85d3f15254f7a
SHA512ccb44ed78b3025a9b083264de4cbd35a62ac651da78607d6adcb19dbab39a7e99a8cb8d4971550918b86042a69e2cacaa82f8d98c2ef8571a4462bfb0cf4f4ba
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5b3e81361e21d0392b647fef6911fdfa9
SHA1302e2204e5f8f7d4cf2ca571394d6c8bc3005d00
SHA2566b3009018fec69161f0eec55b3ff48f628a0ca180b077f641890e3b592750f1b
SHA5127e634fa647815854ef33db24d7874c7a45f4ca611fc0694d680aa933b5dfcac30b21c8c7f4c59cdcfca887ba4d912e2114127029b3f5a65698ef5ad271a1d8a9
-
\??\pipe\LOCAL\crashpad_388_IYWZDEJTKVZZEVSRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e