Analysis
-
max time kernel
1798s -
max time network
1696s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2023 04:06
Static task
static1
Behavioral task
behavioral1
Sample
gu.exe
Resource
win7-20230220-en
General
-
Target
gu.exe
-
Size
501KB
-
MD5
4838cffb6abbb084c90d6148c8af4150
-
SHA1
3b468222f1b323c944f14ec5e6d9e88cf99e43b0
-
SHA256
454aeeebb31b396580032ea5484a998de90f0e8acc5bac19f2cdc66150cfff62
-
SHA512
cd9770457c90ff8e6c0f69fdcbee987058182ae53ab40b718ab450953abcf631a7e54a35b140f743d8384063b8f5499ddf1fdb79055f14a3e5232f7cc6f3c99c
-
SSDEEP
12288:qYMo1y/Os3kV5Jwrg1fgve6QXv9dntE7F/:qYMo1y/OsC5C2fgve6QXv9jEh/
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\09d99a60-8341-47e4-a06c-ecc7cf230fed.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230601040713.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 948 msedge.exe 948 msedge.exe 2400 msedge.exe 2400 msedge.exe 4648 identity_helper.exe 4648 identity_helper.exe 5492 msedge.exe 5492 msedge.exe 5492 msedge.exe 5492 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe 2400 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 2400 msedge.exe 2400 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
gu.exemsedge.exedescription pid process target process PID 2784 wrote to memory of 2400 2784 gu.exe msedge.exe PID 2784 wrote to memory of 2400 2784 gu.exe msedge.exe PID 2400 wrote to memory of 4812 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 4812 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 1624 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 948 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 948 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe PID 2400 wrote to memory of 696 2400 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gu.exe"C:\Users\Admin\AppData\Local\Temp\gu.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=gu.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf28c46f8,0x7ffbf28c4708,0x7ffbf28c47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x118,0x114,0x110,0xdc,0x7ff71aaa5460,0x7ff71aaa5470,0x7ff71aaa54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9243805763186248157,18226059483104451259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2488 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=gu.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf28c46f8,0x7ffbf28c4708,0x7ffbf28c47183⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5462f3c1360a4b5e319363930bc4806f6
SHA19ba5e43d833c284b89519423f6b6dab5a859a8d0
SHA256fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85
SHA5125584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d2642245b1e4572ba7d7cd13a0675bb8
SHA196456510884685146d3fa2e19202fd2035d64833
SHA2563763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1
SHA51299e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c885006baaf70831294f88e3c034bbb8
SHA13b7bf920163ebf097a4b121656ee9d6b94eece1a
SHA256500d5b83a44fbb294fa5f27e14d3cd7618325bd85152bfaa6c98ac5899d31237
SHA512e5fba595b6381299f4c106fe13c4e75c03a313b59e476841f875a80c9a314ef73749a7a9ecaec957487d7bf15b02a20c1757b566eee4b501095a39d64139f2f7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD5c9d9a3cfb0e4a57ce0db5c9238d84205
SHA1a02757fd40b178c0cce92cf7f510fc80d30e45dd
SHA256e413ab53420c2b5b3d70bc0da261efaf3dc57a0bd4f8577f2074484fc17cb908
SHA5120c95dae113d53f357ba3117f9fdf8f5ca8a681655a38dbee4967be6d2946bd5eac5f5d6d64b3f19a827497b10888e914feef7e5b32151f293397a7ec3f872054
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD5afc8a217db8738fdfc53c8bcb9aa11e5
SHA1357f1982588ec78cab974062792079da43da3176
SHA256b5403c1840e0975c2394e690ac040e0fb8254481454f2f100b64cc6633c6b556
SHA5121d5973230bf27903cfc8158f4c76a273270553bda0e8d778dda43bbcf0941405357bfe4d6295dba62b320ab17ab4c5bcca4a0c2d3a79f5020ea52c17d610cba8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD54c40761d3cff37618f834b99baeb2e8e
SHA12b1907d222a7ad6db311e2cbf1aab1f4abd0a89a
SHA256765867a667e1655c3aa3556b6bce2d31cac4f69921da49a9779f8dc1fc790927
SHA5121a2fcc936cd07c3bab3b876b70c634babafec943cfddef9057ef84781ab36ab05d30fdef43585765fed7ea0b8a9d7f239aee0582d90fe87a147e45eeeacd15ec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
566B
MD5381ac45cdf7aedc98e646056ccde4a8d
SHA1168e192b23a595e9f41cf8d107d6c1d601c3ca77
SHA2569f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84
SHA51298ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5944f6eb653bb00fdc2c17a55fcc898b8
SHA16304ae771576d22a6abfced6e84fb2d00070725f
SHA256c4bf19d06bc51407bfc244fbfa470cf27406b49f426a00100c159a73016b52cc
SHA51204f3831ec0d35ab85ff8de9530c16c490d9cee258a41bcb05371ac4ed66ecb5ab11d2f5202a0c1ccbd044a44f2930cadbf07df5111ecc3abb135ec8e075afa9c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51c6752e4fd238f6b25100961bdbfc2ee
SHA11aa564449dd25c9650d7f9a66ed60772b5a86688
SHA256becab572cd7d7bec575cb696ba702114eb3d0612f3ecb539597dab51a44dc653
SHA512946f5138e0eac900e659fb3ef486934cfaae8f509918ed0a21aab0782f263c595aff92d31eaecb432169d474757b56f642a69adfb8cb5991ca5d56167417fe53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5fc587092e0be02ad751348760adf6298
SHA11576cd85c1de98507e9c4c523806207e0b04b20e
SHA2560b8312f6c007df2dea671e0b91b4a91616735d6e6f27a50bb5f73eb06e73dc60
SHA512acc5bc1594355edd46ffca6afb1c36e91a020a814168473b5656579e91a649d11bb0c52290551050baebf8551e27adbb6748664135bc879135fa8817e3cf203c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5130644a5f79b27202a13879460f2c31a
SHA129e213847a017531e849139c7449bce6b39cb2fa
SHA2561306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1
SHA512fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD569b72d0a4a2f9cbec95b3201ca02ae2f
SHA1fcc44ae63c9b0280a10408551a41843f8de72b21
SHA256996c85ab362c1d17a2a6992e03fdc8a0c0372f81f8fad93970823519973c7b9c
SHA51208d70d28f1e8d9e539a2c0fbac667a8447ea85ea7b08679139abbbbb1b6250d944468b128ed6b386782f41ca03020e3a82491acb1fe101b09635d606b1a298be
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
538B
MD53d8ca0592342ee61f66c7ebf99f1c8ee
SHA1c133bb3bd8a5441a1ce3b67ed2af3c2b302add6d
SHA256d513798796988cf56f19df39e0b808aba871a5d59bb50598f6aff2dfb369242b
SHA512dc2255f5e1787c3c71108ab6a349bf143504ca75d47a0ce7434d60bab6e86bbe2eb98add2b184b62822aa1d5bc2a192cb312286301ed5b5d344b54a2b5ad1819
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5722f9.TMPFilesize
536B
MD54cfada07bde8a03c20612fa95848ad46
SHA14f3400fc666e49ae6d452e96f71fb02b361053e5
SHA256c51eddd553b37656c791518d329cc00b87f1c110bdcf442c08a221f95c69d4ed
SHA5120fa0806717cda20332856d7713cbea2e08fb1b072b63930a9eba8ea82007b6173e653eaaf937b941a1ef46671416030e19043d95e59dd298f2e05df8a537820c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5e36d96e3f65441c2c23296aaa17cc51c
SHA14b4923bac5d3cc5f66275f9c72f61c50e6b959af
SHA256f432d0fce2fddbd08df8421de771f855050f9d0beec381d3948ec14fd87c242b
SHA512c13cf52acec9e72adde0bfcfd3e21f350d647b1646b084c9718b96c9f8408d9b0a1939544b73142debf691199031e08290417ea9e92d39ef9122cc4acdf8afcf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5022ed80ce4b22a2ea97be92c830da47a
SHA121badc821e0ab831f59c2e234d913c7ae360a015
SHA2564570ebe455a0ae9f1b59b3f3141d50b470ba262bd07f49ed7eb3e4082a2d7465
SHA512174c2eee8ad44415eed914862aa1a1a44174860a3740fcef9fb36e7f8194772de23136469420ed5638d6e3c3cf11493be4e6dde4375dc91da13c58a4cb1eaba4
-
\??\pipe\LOCAL\crashpad_2400_EBDDJQHVTUKIWFSGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e