Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 13:25
Behavioral task
behavioral1
Sample
bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe
Resource
win7-20230831-en
General
-
Target
bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe
-
Size
326KB
-
MD5
5617d8ab4b0fc15232aad11758b00709
-
SHA1
69344826699f76b46312db85cfb2a9897ef0a92e
-
SHA256
bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac
-
SHA512
cf21a10f513dbbdcc5af83abe9353cb869c2d1acbe62541e8d68d7aa41ef163dd22f9298341d7c4ffbeea2d8492592ffd69e4497de035f2ca587c3cea7e5dc60
-
SSDEEP
6144:2XrWREQmfioxTH+zHVt2DhLxZ8e5u6NMxZgkvmkdm6zHMzTy1SVY:i7TeSdg77Hf+Y
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4740 msedge.exe 4740 msedge.exe 1204 msedge.exe 1204 msedge.exe 4584 identity_helper.exe 4584 identity_helper.exe 4824 msedge.exe 4824 msedge.exe 4824 msedge.exe 4824 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exemsedge.exedescription pid process target process PID 1900 wrote to memory of 1204 1900 bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe msedge.exe PID 1900 wrote to memory of 1204 1900 bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe msedge.exe PID 1204 wrote to memory of 4944 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 4944 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 1748 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 4740 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 4740 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe PID 1204 wrote to memory of 3856 1204 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe"C:\Users\Admin\AppData\Local\Temp\bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe111a46f8,0x7ffe111a4708,0x7ffe111a47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8160743011796258483,15466754982050894942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2816 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bfd1e7d1e54199b192ab749ee10481b45607f5ad527a1f3f57dc1184e1b556ac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe111a46f8,0x7ffe111a4708,0x7ffe111a47183⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5bf009481892dd0d1c49db97428428ede
SHA1aee4e7e213f6332c1629a701b42335eb1a035c66
SHA25618236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5bf009481892dd0d1c49db97428428ede
SHA1aee4e7e213f6332c1629a701b42335eb1a035c66
SHA25618236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
264B
MD50f68ec3e87a2d488ac5c8cf31cae3ba2
SHA1eb6e089433f0a647d3bf5734e0880c884d6bc0bf
SHA256d49b804017efeb26d20bcbfa33ef3d2e225378a0b7193a78ab3da933aee7d941
SHA512bb7fbbfd4b9df1c86c3f6d9953d630d6511f9d67fb985d639d8e3c6ac22e8594aaa8f26928659a9529ef34d0357d2fe4256af6dd05890500d10ce8b15b8d36a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
437B
MD505592d6b429a6209d372dba7629ce97c
SHA1b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA2563aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD57c46457e315f6331883d7117ee79dd80
SHA190a88ebbf1c11ce4b32b5ba9b24953a5eeab21df
SHA2565ec186dc2b9076e5b603f42d9950b5546fb73a0435c5fb53af86b19732bd56dd
SHA512026f63354bef2c280bed2e366bbd1d047ac21aaafaeb81a96d30a976a291eb0aa47510407655b062f5a90fccffb120fd6cc2efc8ecbfe613036918e01fd6906d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c26c72d171d7cf08f6dc2fe596afa9ad
SHA1126168ea0eeff6bc0d1f3b00350f080e3f63c54e
SHA256a9d3504410977f2aacb866f31e0ccde00f68f2169818d999e71420cf6835259f
SHA512e685f24d71977568b27b9739868a3f477d1897c62e58a88f5af1ba403712b991baf91396a7217c78d4c8f2b00061d39e34916dad040480b9e4b4d27d1f815328
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD525ac77f8c7c7b76b93c8346e41b89a95
SHA15a8f769162bab0a75b1014fb8b94f9bb1fb7970a
SHA2568ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b
SHA512df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
371B
MD51323dfafd7ba78ce902069b8fc80590e
SHA1f63b1c75c8e18e237522554f18662894fa07e946
SHA256a097bc00f3335b7f4aac8254ad83c95200b78220314b5657fa27d79e8ed399b2
SHA5125886c588cf899f7469ed3d5d1aaae8d9e404e1b5ca78105f3eb758aefc83c1ebdacce511a0917a1b651dcdefb66a7b560a00fa0c17aca7552ec1c57b01c5fc73
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d987.TMPFilesize
371B
MD5dacfaf555d293f28e6c7fbf2e3f2bdbd
SHA1ff8d6f5edf823b220407f925f05b342e8622bf82
SHA256e00d5f3925f4b47dbea589dd91a1c4f5f7d8a6c0490c6cee7a17f95965733001
SHA5126541883542bf8b77cc75f221fdb105fd8d1078417a4be2aa55d99efbf78979a81233aae0f051bd1ea25bea9879dbd891565db4e1d1c7a8ef62a00b7cddc50a62
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5ccd1bbab816d30a12d2fbf94a028e17c
SHA10105cd0d6c7e3b4fc6b7e5e1af1a80240161d5c9
SHA256020632c6b6612aa58c0ddc0ec9f171c1ca4bf0804c6343256baa6efd6bb8f5db
SHA512c169a6af11e30c9ee802682e6f014ffe9037950ad890104eddff3d02d9078b4af572ac6d2f35d4397e425c15229c92c5fd580a62b39aa5a59f0b667ff574700e
-
\??\pipe\LOCAL\crashpad_1204_MIRNSUHXOEPYSRVAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1900-62-0x0000000000F20000-0x0000000000F76000-memory.dmpFilesize
344KB
-
memory/1900-0-0x0000000000F20000-0x0000000000F76000-memory.dmpFilesize
344KB