Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 08:54
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://fabricaplasticos.com/apps/xncggoub/bWVoZGkuYmVkZG91QGVkZi5mcg==
Resource
win10v2004-20231127-en
General
-
Target
http://fabricaplasticos.com/apps/xncggoub/bWVoZGkuYmVkZG91QGVkZi5mcg==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3616 msedge.exe 3616 msedge.exe 3456 msedge.exe 3456 msedge.exe 2424 identity_helper.exe 2424 identity_helper.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3456 wrote to memory of 1056 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 1056 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 4892 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 3616 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 3616 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe PID 3456 wrote to memory of 2620 3456 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fabricaplasticos.com/apps/xncggoub/bWVoZGkuYmVkZG91QGVkZi5mcg==1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4d3d46f8,0x7ffc4d3d4708,0x7ffc4d3d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3560 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59757335dca53b623d3211674e1e5c0e3
SHA1d66177f71ab5ed83fefece6042269b5b7cd06e72
SHA25602f0348e2af36f2955efda1613dc6480f1c68c8e55f19590b7b58e9355c6a940
SHA512f13351398f5dd5b6cf638b174dc50ddc782b690c6d4736d48941923a3425b5dff4a9aa0da22773e9abc9559d40f020f268018db902e0a7772b7b1f4d21126f21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
144B
MD59d8475a02f972063cefc0f0f9e17007c
SHA176c0acf70dfe5cf3d9e65502a37d13c2db77c787
SHA2564c3e1c9596a0d586cb7e25c6d2a725c4ad08fd110d04f219d2822e516b92bf39
SHA51209c3fe7ca5413e6dceafb25e17b4f3e8714fa16c281f8d84332fb8b6336a873ba2eee4a4e97f99c5f66a18ed91388bb7c93c637e204d8f8d7ced09d7aa1c5f10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
655B
MD50a89071335f7f0e75cbf8d072e9d1c25
SHA16def3f6461057b76aebe2d099fdf20fffeea7e42
SHA256ba89f1fb0d4f1036892779aa895af353a007fc9ebba3d260219a5ca2d41ba479
SHA5124e75ae6fbaf55d0cb0790b0817e3ac078a1a3e7d234d9c4239b73df93efb8c8c056289487a731a903fdd8f0838ca73641e6fc53c7a156f84b2544451398d36e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56af8bb5b280cf5ea5a7b30e4f73aca22
SHA15e513974d4fbcd9574a63512c85b422ddd4c5950
SHA256f9b3801249e50d97ff7630a7d5d6436bdfd3a5340e27f829bff3aab37862d79c
SHA5121c632c6756e29070378329935baa674f90c838175da2c4a2b35494c816cc5018bf390aec6fe8477267a8e634ffffb7ae70d3c2b1334c40609926eaf5907d1398
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55e6c9d077d5028c68c6a68a96adfc4a9
SHA15ae8792b7d5be46f593a2e694367dc41385845e6
SHA256935c911630be0c4d505abc4c9f9259882c133422ad3101c0bd6cc537c9fe666a
SHA51206d97457c4244414484233684f9fa67233136bf4950861764be1ed0b1b7c7192f4e07c98a7856fd59083138b2682bbb1664d42cfbb070f39d800a85c2433e70e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5100358037244cb2cc73ecfee55bcc5cd
SHA1cc8c8cd8ac11c8290c92ad5bfe2cc86d733b72e2
SHA256d6898ead92cbdf9778b58556eb5eab6441d3bb9c341220ee2d8e51642338964b
SHA5126c81c3a186ca62213a6313d15c018a25b780e24dc0577522ea43ae7bdfe2c68b85e815317c12b921e5b78cc8510bdfd410aaf44e06056594e8ff3ad6d88c1ade
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5c0499655f74785ff5fb5b5abf5b2f488
SHA1334f08bdb5d7564d1b11e543a2d431bd05b8bdd1
SHA2566aa332a4d21802b2dbcd08e153764da60f538ceb0daaaaf7504ba8f67c08ef03
SHA5125f0cec6dd823f2b3ac62017383dbbf71ed38893724312ec75e73fb197e0bcd5418bb70fdfe9150f5ca495d5f8547d8a08618bdacb5010514a3cb1101437d698e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD55b9f8218ea0c08f4e933222d50e40ce3
SHA1eed00095727d34f1f3d46ae3872377b9e0f6ddeb
SHA256ca6c95523b2397b62caeb579ffa307769c5fb933a5472095ea14eba19b3e207a
SHA5128a2f782ca846208bf3ece1a6a55d4c4106f42aa71fa88eea26a33f355f89e81042a133c96e7bdfeb0d9e238bfb9f10dc4eeaffa8e9e92e87324c45de8c209c9f
-
\??\pipe\LOCAL\crashpad_3456_LSFUXXAVQFYMULRWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e