Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pdfcoffee.com/stefano-rodota-a-vida-na-sociedade-da-vigilancia-a-privacidade-hoje-pdf-free.html
Resource
win7-20231129-en
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1532 msedge.exe 1532 msedge.exe 3504 msedge.exe 3504 msedge.exe 4588 identity_helper.exe 4588 identity_helper.exe 5276 msedge.exe 5276 msedge.exe 5276 msedge.exe 5276 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3504 wrote to memory of 4256 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 4256 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 736 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 1532 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 1532 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe PID 3504 wrote to memory of 2620 3504 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pdfcoffee.com/stefano-rodota-a-vida-na-sociedade-da-vigilancia-a-privacidade-hoje-pdf-free.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ad546f8,0x7fff1ad54708,0x7fff1ad547182⤵PID:4256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:82⤵PID:2620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1132
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:2096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:3652
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:82⤵PID:2996
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:4844
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:4296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:3980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:12⤵PID:4292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,1523349512006992353,5002377197847091803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5276
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012Filesize
248KB
MD558dca57d7291b0b3f94df7b57b327525
SHA1024d4c1da91fc6d57a2a05e725817e6ab9614f7e
SHA256564c6b8739a5021fab60e2c156bc12650b861ebc761491388a54e34bf8b80fd5
SHA512e0ad43cac972879e955f4ae99948702c724976daa935209a9c2576c743c80e5436befbe778aa46a61befc205ac6fbb2576c4b4c18e4b6355de3e01d70425b42d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014Filesize
192KB
MD55036f7c363373f5d9cc2b6519806feae
SHA13caf2148a2eb7c82f9aff0f3a2f4594ee70327bf
SHA256715c5d3e3839c1b47c3008e8a89f929e60858ee379724a20775003c692e9fd6c
SHA5124661cd6fb02dccc48a42fe127b1e88f7e794cd4eb1d8a5a8f5075f772dad63211efa349bab579c5bb81bfb2c4b1be201c6725a56f617f8913a2235e3565fe645
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
480B
MD5ff3feaecc7448e2385c0889ea0913da6
SHA1478c3d48f8b9905365c544982ecf2f56f54b869b
SHA256f428e470a81aa4688d951bf27b723c39ea99ba2d707c0f57ab751288720d0023
SHA512a4d418762928dc1aaeb4523e6cb7a1608aa67d6785c85bd28fd7ccb92c655f39579876bc90192d3144ea3404fe8a6f50f618883511d4fa0850c0a19a467738ce
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5766db55305d32bf4a217249a55c40270
SHA12a6afa0998abaa5ae2acd12738028c260dbe88bc
SHA2561de965873ad2c25640bb36991e812f2e448095f66ca418aed01ddea4fad01f80
SHA512433323aceea5fc43ed8ea0eed9f1717c5b32c14fcf7f2c2ceef32862d871d8a090ae57f0a081c124ad82b534342f72aef556ace10315b0f64ff8931d88026fe8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD597678417f63a2fa7af2b81aa37d3864b
SHA1155acf312c44dcdffebf66db9d126bd4d0d81351
SHA2560ba9893766bfce640ca5cb63777fe75a05257c58879c789b92fa785cb34ab73b
SHA51263a2e6a61972aba474fc4ca27aaf5af8d327acf230b1a0cbbadf5240811297f77dfe12ae0578a3a703ced78030c9e42c0b2be302d13a0099bfb65f0701375108
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD53e321e47d33b95f9ac4529942c59ea2b
SHA119c57c2f71093c5c2c6ab3fd2f60eb3b7710c5b4
SHA2561e17eb2df6d134f25f4f6a7ef99a56b9802ac4eaea27a22f4b8953a8d2644da1
SHA51215499acfa9b431f11dd654cae608bb1fe5324d2d75494e0d01f3b701535d5cc4c6e45d73b68f1fbec44ce55eca783239bd841c07c551a00db25e208b1d72d1a4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5c3973b405d887fecf7f283e5d8b8139a
SHA198bf968dc07c2cd5f6aa6556a7dbd52048cf0519
SHA256cf34f8d3b1244837aa427f5dce82ff1136dbfa95c5f0dde762bc191aec8478c8
SHA51200651629ac33c503d176bc73f630500ac60376e8d9b5a3bf1116bcb5f9c2be05ceef8b6d6f998127e236b5e33558fa2b5ffdc761b6c31b87dac80178086d4425
-
\??\pipe\LOCAL\crashpad_3504_KKSHPOPRZLPMQCKFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e