Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 20:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://unidekor.com.mx
Resource
win10v2004-20231215-en
General
-
Target
http://unidekor.com.mx
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2900 msedge.exe 2900 msedge.exe 4852 msedge.exe 4852 msedge.exe 1116 identity_helper.exe 1116 identity_helper.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4852 wrote to memory of 208 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 208 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2360 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2900 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 2900 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4476 4852 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://unidekor.com.mx1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9273246f8,0x7ff927324708,0x7ff9273247182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18434901945197073091,4079048648517558409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5424 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d5564ccbd62bac229941d2812fc4bfba
SHA10483f8496225a0f2ca0d2151fab40e8f4f61ab6d
SHA256d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921
SHA512300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5e57151402e7ac8410397d35f18ba66a9
SHA1bfb930ce7c320aead16edd20ca9acd1ba5d27ead
SHA25666799a13b435b08cde5cab9f03f4a279abeff19ed4292c512dae6a862a5b523b
SHA512edc37f537e67978daabfcdd14e6bd414cae3574f301540a52942496ee6ebf517b3f4753ed0eadff8e2e32a7f8e00ea8aff02bbd8a84c952f767423b5c5577414
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5bffb17c6392f1f870087f97286bd28d7
SHA178cc3c4a5c2ddb9f50df41d71f5560e9d1766377
SHA256f36b69c43b0a7738be3901539c329b8d359ad08cf042d7154299a271ba04fc58
SHA5127a37ebdee1900c14235f1c72b45b6ea9003ab4687f82033ff2eb4b4b6b872c8609e969e9139221091994538975a674a3fbadbc5869b415214419842c4cacc68d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD519776ea33ebf5ef7a6a7799d0b39a396
SHA1d738b81e0199899d04d7081713a0fde686a473aa
SHA256b5d83024b00703fd4fc41d86169aee5a674e4234bba17efaae5c6290fa8a5884
SHA5128cbb2f1eab57c034be6404f58533c90d8f2d33a99cffc890ee9528b1d0a815ec79f00eeabfc7a6c42112225886b20aad71cf9b3d318f307d12c3a8fc3f59789d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5955a826798f75f0adb4f8053aae22618
SHA147b428ffea27604d40b2f9d86167323a0a77392f
SHA2564135d14a4b98cde346a9b65aa424f8ebbb2c6678734ecebbdb76fda7695667d3
SHA5126f7899fe458d538097d8811be2054755e4710740a167e4164a6a4e0369830a0846ef1e78f301b102cf77aa64bc8ff11fb7bbdfe7ba088609394fa71bd2532a02
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f1fbafcf26a8d61cee9b15d4286a80b6
SHA1c9f50740e5417a5ba7b0bc136e4872428bf2b5bc
SHA2569884be148ff722e3348d904a96d53d7c9b4f9d3eb1c266aeb9b16dbac76ec382
SHA512130256b74c95cc01659d844efd24f5a4ae8ba164f12542b36d470b4a3b9f5b912f455464ba56aa45f7324f2c34720bcba54153da77c347dd2834d18cc72fe448
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58d6cba61f297210803f87b7196dd9bde
SHA196e9104bd38e2e159e44cfdfa96471705e0c6683
SHA2563fb1a0ac82925537ad0735d314ad0b5f8e9bc03f998f313364fa2588e18585fc
SHA51286ce3d51562e38720362e2e3f2b4a5a87cf868c09d7fcd3e43ace35d8536b46a3b52612aec0ff723f201878ce44a52c2efabe21f4d32c49636642eaef5733f97
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c7b23772ed723990858d1d43dd589a5c
SHA11711326711fa0184c1b51a7be67cd9750691f3b5
SHA2567fcd991ec8e85d9fef5842c2a9cb022ea2a6e34d5b276081fb1bc988f782231d
SHA5122270fe88253c4aa5573962f5d7929a45a92d48261323775d91fa5df9cd270a77929d5b26dff2426a49c70a3abd15de0378b631c966d255ba9adc5bf9153f8e2e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD51d1c7c7f0b54eb8ba4177f9e91af9dce
SHA12b0f0ceb9a374fec8258679c2a039fbce4aff396
SHA256555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18
SHA5124c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD53c5a651c43c2642ba6f035bba770ec7d
SHA1b9938ef33fba64d2bd11e848ff5569a72a6b61e3
SHA25602ae1c7ff41db4d46aeddba6e8b70d9b2bb9dfd8e01b3f0f2013c43d2441ab6b
SHA5121d47629f839682a1a1db7f44899329f1eaede05e6e2975a81d3c7b5c8adebc188a2fa83013ef0253c632355061c5a1670469838bed29bb946a8b460462a7585a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58219c.TMPFilesize
1KB
MD5809209de75401485f786ab4019aff7af
SHA10782d86e2f938a8c512ab95c2f02b8ba9eabb9f9
SHA256c6e6e4d92ef7cc0ae83a72ec5a91aa7a30028d9fbbecff8d13f71cf5f21be52e
SHA5125d695dc106764417f1e764efbd79b5d0ff64d070a6bde933daca866dd58b7e8373504095fdac975bfcb44b6d6006394d84e0786126cfe5b39a8949528d410c9d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD50fab97edd0dc2a12085d7dd26b2f86cc
SHA1de5063efdb780971e8aa71dfc97c787f375c834e
SHA256ff51f8531bdcaca580120b4a897417fa2f842c40f223d0b6176652c43004da33
SHA51224d27c897fdc4af21b55314374d9ed907a222694b9ba770bf6e2a218df372952636e0dae1e52d37e038b5263498416a522373f7c262bb23d1fa9e991777b42c3
-
\??\pipe\LOCAL\crashpad_4852_BQIVFVUPTPCLXRNZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e