Analysis
-
max time kernel
82s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2023 13:08
Static task
static1
Behavioral task
behavioral1
Sample
cyxum.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cyxum.exe
Resource
win10v2004-20230220-en
General
-
Target
cyxum.exe
-
Size
1.1MB
-
MD5
394c60237c9e91bf7efc4832424ef51e
-
SHA1
a176bfac5c7c3c51075a54ee852a10c560e922dc
-
SHA256
fae2d370a412eacf6f1e7ab76a43f1c8bfba253a5b6630322aaecca9978ed957
-
SHA512
e5f25f03ffe24d12ca1b390833996a2f36c4c57455f42fff9e8a0a27e2841c4e5c20b32c6860324d414e6fee2c9de69a4ed7d7780eaa9ee8302ddc9d3dd7c25c
-
SSDEEP
24576:Us/3O8IbK5HdekH+lTZeO8uTRzKJeLjEeJtIVw/5zJx7K3BUUu:V/3O8XdekHkTZBRzK2jEcIu/NDK3Bc
Malware Config
Signatures
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 88 whatismyipaddress.com 89 whatismyipaddress.com 90 whatismyipaddress.com -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\39285a9e-a166-45ca-b5de-7cd3323033d8.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230527150935.pma setup.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3852 4964 WerFault.exe cyxum.exe 3192 4964 WerFault.exe cyxum.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 3944 msedge.exe 3944 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 4180 identity_helper.exe 4180 identity_helper.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cyxum.exepid process 4964 cyxum.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
Processes:
msedge.exepid process 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cyxum.exedescription pid process Token: SeDebugPrivilege 4964 cyxum.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
msedge.exepid process 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
msedge.exepid process 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe 832 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 832 wrote to memory of 4736 832 msedge.exe msedge.exe PID 832 wrote to memory of 4736 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 4404 832 msedge.exe msedge.exe PID 832 wrote to memory of 3944 832 msedge.exe msedge.exe PID 832 wrote to memory of 3944 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe PID 832 wrote to memory of 4872 832 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cyxum.exe"C:\Users\Admin\AppData\Local\Temp\cyxum.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4964 -s 16922⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4964 -s 16922⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4964 -ip 49641⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 4964 -ip 49641⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd9a7c46f8,0x7ffd9a7c4708,0x7ffd9a7c47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x104,0x100,0x244,0xfc,0x7ff645985460,0x7ff645985470,0x7ff6459854803⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7000 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8412 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8028 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9324192770260805401,7571540556586624701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b8c9383861d9295966a7f745d7b76a13
SHA1d77273648971ec19128c344f78a8ffeb8a246645
SHA256b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e
SHA512094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD591fa8f2ee8bf3996b6df4639f7ca34f7
SHA1221b470deb37961c3ebbcc42a1a63e76fb3fe830
SHA256e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068
SHA5125415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000dFilesize
27KB
MD5c38d86a2b5eea9e823662c4ced969527
SHA1d9d42845ac4f59b9ac28ba5380a8ec02646efe3d
SHA2568731878e6c79b29f4e6e52a6c3a6a023de6d85026a965cf994b71e0851abca9b
SHA5129178e814ca9bdbbee0ffd0d2d4faafbf06f693b5b0f48f18f40550e92ef9151859c1d8b605c0d29e4470917deedc96ead59ed853e37e4628b5327637d8a88c38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030Filesize
52KB
MD5f1d940934104403f5137326321666398
SHA1b2933505d6b2dff6001d156e5bb07939ba455448
SHA256f6b67b8459fc6c73cd20c39fc088ab67f577ff0a45f1aee14943734fd8956300
SHA512ae20f70c15ff70cc089b1a715299267168a4488b378c57218a977232f2bd0b224c7a8267fa0345466655f4c6778856c594153cf4d56eaed64153466a6053982d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD5fbb3a63e33e8655ac5855b001b5ce439
SHA1047042b9157066874c03a8c22ea3887df356e77e
SHA256645e472d74c5a85fa99aa48c29fffd1caa592a5d3668a5b888dff2d2b9dbe0dc
SHA512202023677b34780edba5593c160af163a64adea9cf7723be744f3329f59010439d1c14fcc8001461fd7f6eb813f9d38ecb1c370900032d0b07c2ccd81071fd1e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD5dcdf6df9166f527468cc05fc26898f98
SHA15550e3f95076848b9be3c3b85e1a44ee0f9a444e
SHA256bf893c6ace6e1dc0027450de7a6403366cca3a4ddc9f28db1aa49a5d6af388d5
SHA512eb6c355f01d5df087af7da5bec400ca3bd8c2e38bd7490945f5040f84b23a2b0085169519acfdf0cf49bf1b2abe4094b2974fcd4c93c2b5c6c7eaf179eddbcfe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5d4b4634ce53af959582275f9fdd438b9
SHA107f0e8907f036623cebadf87848c8d000a01bf18
SHA256c80c5835e993f6fc2c8d1fbb8bdde9e3a19204e54bf9a479d216b33b61de2266
SHA512e5f5437e1d53b3be27f66e84b1bfede3be8cddec77f41fc1c7a7f5a5ff148c9833d098b723786950ca61ac19aeeae939a99e5521083d759395a2a4b215d85a02
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
13KB
MD5677652973a44b85cf075aeef010c23df
SHA1a82b7afb2c390c37dab4deeff5f1c3ff088b904a
SHA2563e95452396dc6c03fc4380142dca24e12a34e01c1c0fa1d4d12e56b8239c32f9
SHA512d2550b3bfa0a67c6d02fd3b582471caecca87e1d2223288d673c5c2e9497520607df6d76fc20c3036dcba5f54a2818694239a1435b03d6ef9ad58ba637771c44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD54959190c3cb7c6bbebc51c39233a97f6
SHA12a67ba4653fe192c564474c10f78f188003cdaba
SHA2560811ac885879ea7568c662713f9833dce987d58d9611557613e6d4067011a54e
SHA51289d676a811ad4f96e5ecd4362d83ec48c55bd15b172ab81d1c59eed0708786943d763a1cb24ac20bd6a72479c50c1d48fa754fd2b0711ae2095b162c3ef8f75e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f6cc4d1136f93c0474b11e1b347b6681
SHA1a8cb0a8d2466f4adf4658af46452f32e1e4c7fe4
SHA256ec3a13849064214e7ffbf84e7ed060e09f4e7ff2e481dddc8788eec2f374632b
SHA51282a6ebd8cbd3def3839db6b4986e2ebeb8e3777a146de02c3ea06e0d540e5fd508cdd0915c334a65226b78334aa19709d812fe77aeb2e16ad699798db5ab0a51
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
13KB
MD59ed99c4b4f129b5b1d4a065bb24d9d8d
SHA1b01bc0ad8f65a641b60806a061ab417c6b15154f
SHA256c545dfd9b441b350d95ceae8ea84065426c7370e19d7b1fe5318584836ef8788
SHA512c6bc120f1d9d376af312bdb721825fad22847f59d7a49d734b427e8d5e092fa9db564db01629ffb52f991a2ef6cf96ac3e16dc58b6ca93648b0226041af43d7d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
15KB
MD599b0a0b7f1868c351808978974c2d733
SHA1b56a4ae6498506b6c54d1510fad5a1bb9c073ba1
SHA2564917209d9e26188995f6a4833faf905219c3427886e520ec0cdfd4814f78cfb1
SHA51241606f3672243c72df76811746cb2b5f33b3083b54d825341cfe3b17fe5df64d7a29aac3267de5d9b490844e3e260c27659ed0aed830a872a2df7c02c3a4862f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD560b345592703258c513cb5fc34a2f835
SHA139991bd7ea37e2fc394be3b253ef96ce04088a6d
SHA2567e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300
SHA5120346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD51e5ba0451ff36f3ea9e13836ff06ff26
SHA129d9432a220b56a8aff2ec973bd6006dad895117
SHA256be939c53dedb05948868aab0d04a7a31d9883884262e1da601e23cf95ca80951
SHA51210247ac659e1ad79d1984e617f9ded79cbddfe9c69177968f385729cf7d934c3ca82d4da8ad5dc025336b2ffdb0fbb7629fc0c400896304a5a71a001d030ee9c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD526b182f4cb9cad62a274f001ad0deba5
SHA176b8a3c88cadf36526e95571ce762ccb76a1cf85
SHA2568e8dd0c93aee8ae27701b4dd98bef145cc928237b3109fd1174c85f76b6bbe5c
SHA512064576f8c8f8ddf57da5f03a307581a44a8f3952bf0f7b3df618cd3d8a80c27ec8972b0f3fd066487f168ac7733837b6e8d870d1f3ef2f46ab653e1a11454bda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD508f9ab577a8899ad6c6af3e54fe95332
SHA1f34c268649f22711912493bd1ed97204ef96741e
SHA256e2b687d5b96bd2b4f14375b8b816e36cfd66eb92e54e591f2cb699d641df7c5f
SHA5128b8eeff38b1d8c484cbb0d7a60cb45a5e1b8384d9bb81996a62351caaf7771ca3ab72dd78d0af7665a1386bbf1a8f9f285caa5e27afe6aacb7bd2a1e8448cf84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57be20.TMPFilesize
2KB
MD5d671619f660a78b51082bde49d6aa613
SHA1f4621c42de455efc18c8c1688246f6f2f6823505
SHA2565a0532c21e85c42573a0d871662b0147658b9f9160d36d56bb2118a5f0ee9f98
SHA5121a43b7b5fcecdde11de73fdd03f7652df42b106d51d0c4a1668650cf4ea6361078c0a35d1dadb6cea88884e62e6ec1b6ebdcd7277d5b022cade6a77a94052efa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD51f69bffbcbd0f91419d8be4c129878cd
SHA1b6055ff73c3eaf9f543e90bf1cce34feeb2cc945
SHA25619a04797cb5e9a385aec4c052d96927f08670fbf55e99ee5f7844dfd51483a11
SHA5129e7b96b034b0ba08b2a81a0509edb9414b8830ba10d82459c85f5c31aa5cd957caa89adccb38b6897a0667668ebd42d7a7d735eee9951d7872d934965aafbb63
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5c28b68da6bfb9a15ce245a7dae25a070
SHA1aef1bac98282ca3f38439895df651ebe4f0f56ca
SHA256be6e1becba2993499694dc37626098f547ddaabf79381a7637c2eb39a1d6562f
SHA51287cb629fe92c57e35cd133e65bc04c26ced4e7dd7f8a2eb40d31d41c735db02dcd6c568996d01221d56fa1c7f9ec6f9da3262956d0e31f62953d634041e10a8f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5e1b338ed4c9d04b33230ca9877fb45d9
SHA1bc0ced72dd846026ee3a0a92e70d9471a393b438
SHA256cd6487ebf17650995266da21d7b8ad179e77bdec91cff7cdb845fe5d784ffec0
SHA512cc5703791df340b92005f70c04a8303712d5441c5c2b1e9ede52f918b29da79c7bdf4e729ea8148a1836eb13ac153412d163f71f38ff127188212eaecdd88a1e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5a82d785fed59f637e0017e242d041ce3
SHA1624bd99a81522662615debe9bcbff149a8713e71
SHA256bd03071d28155d2bd71ef7b1344f53330443d3c3e4c3cf097fc8e53af0c9f3f7
SHA5124f56493184e340c9e4640e803ad14c4bcb83ed84c150b5f40ab2e6fa368e69a4a040677d8e1b9f6a07ab9626effe2bee529f76cda052d9bcdc18556b130eb26a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5133d7172254d6768805d315933744c68
SHA13523ad8c071ebfe0d705ed810265f85e51676f2e
SHA2567d7da3ae25531b4ab233c75e8655be7cad929ae1142b5721adbc71a38904677d
SHA512e3c50302a39a25f7f0988a8d7d2d6ffe6fcb36f902a5c90be6a1a09ac030bb5f289abe9886d21fbd6bba281a39fac406039f86ac57729ed1111fcbb8632a5662
-
\??\pipe\LOCAL\crashpad_832_FAXZMJSKIICNNHFVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4964-133-0x000002AC3FDF0000-0x000002AC3FF0C000-memory.dmpFilesize
1.1MB
-
memory/4964-136-0x000002AC5A550000-0x000002AC5A560000-memory.dmpFilesize
64KB
-
memory/4964-135-0x000002AC5A550000-0x000002AC5A560000-memory.dmpFilesize
64KB
-
memory/4964-134-0x000002AC5A550000-0x000002AC5A560000-memory.dmpFilesize
64KB