Analysis
-
max time kernel
46s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 19:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u.to/8ShmIA
Resource
win10v2004-20240226-en
Errors
General
-
Target
https://u.to/8ShmIA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 940 msedge.exe 940 msedge.exe 3880 msedge.exe 3880 msedge.exe 4736 identity_helper.exe 4736 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
msedge.exepid process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 1856 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3880 wrote to memory of 1536 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 1536 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3580 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 940 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 940 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe PID 3880 wrote to memory of 3028 3880 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u.to/8ShmIA1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd864646f8,0x7ffd86464708,0x7ffd864647182⤵PID:1536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:3028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:3800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:1568
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:82⤵PID:2112
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5928 /prefetch:82⤵PID:3260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:12⤵PID:2184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:12⤵PID:3456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:1116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:12⤵PID:964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:60
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11740143948141017108,8240510143884924639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:4784
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2320
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa395c855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f07ce1d-4dc7-4811-8a73-7cf28d0c257a.tmpFilesize
6KB
MD5ecf3c21fb3a5d4cd5b4612ea0edb019c
SHA1254c8ec549c25d6a3e85e9e7f4916e3e18673832
SHA2568d918a802c741542825c08af93f192e5179c61c53a8170f70591f7d40de951bd
SHA512565645f04097123be53262b8c3d94ecb37c3acd5a4f136659d4a69a55954d5ea0a4a0cbbc37902a33d52ed9acf96f2fe0d34279d4134d25264334c73506d87a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD5bb289dc75c028601a3b170cb24f391d5
SHA1f4d06106138a027400f6700f62f09c7bc2566161
SHA2567132c301e7f3c66811675b0fbbba464a1a270f725d60d75a24227992a386bb72
SHA512100a5aaf419dc4e54a008ad005c44ece8b6a982e2d9c594f9e4068ee77ea8cfc3725716ae3d6d54bc2b03ae1a512776df5a513e9c96d8791264385902dcaed33
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD538bde86e816fed42afbd7ff21f257258
SHA1d1bc39f5dbf948f558f234512289e0084cf560ad
SHA2561e012dc47245f5e7a143962c9495eb3c5c3c09ef7122b1fc3077d1ff2116abb0
SHA512f6186a3f103adf9c447743fadc3eaf5b644c5ccc198952484496394189b90698d8099822646a214b5f69f677ae39ce18a52b2f00abe5e03c9639512bfe1e236e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5003a3a48ad6ea8e6d93cf9086660643e
SHA1d0aece0ebe549c27ce510a39a87b5ddd56b49f2b
SHA256fcdcafc7aa2024dc4a386fb25682f1aac37dcbf1b6b5e9c7159240d4cd7a66a9
SHA512dfdbf5ac804f51dd529d8bcd64fb3a31213767e4ac0f471214038e01551049a02ce0f11146380c6ddfeede53fd5d7f33b064c424c91219521a12f971e39394c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5db013a4ba304574bc280b67b42675354
SHA161d1e969de5b4992d68f017924d973058a481842
SHA256afde5b12edfc979a1c8af53a6e7c83ac351feec254cd008141eb0b731fcc62a4
SHA512f32b4adf07360b8ad3dfe9acb7967cd8b4cffe4ed7e76f88d19b011b238832c998ab168b460e2f432cfb66f2dc9bd473b6679e1523a11f0e0eb2b2e3133a3d86
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5966a1ff411156b9ea4d2d8784aa2cc72
SHA192b038eb266d4107e641d6badc379376ddaf7960
SHA256ccf12c35bb401e74edc7cab889d1e6af8c043bb3719ba1534a308522d628e638
SHA512159a55db9dc70548dcf004fc598816d3a7ea47326fef50bbad30ab1d6eeb926cac0869c79765c4cd95a86b53d052dd264b047da081ba3d73e8c24cb324c712a4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5325f05f6710b71206122e088715f395c
SHA14bdaebf2729d5602f227c0a42c21621471d13223
SHA2568de36ffb8d6920da63be372b9621e163c1bc83f710ab79c56c0cb4cb3cc1bef4
SHA512df5f258748de1ee743eef7cbf39dece1944a32440bfd6e79b339fde52a003f3755a76583bb7bc104b4cfae5a94d0d0a95e65702041eb193d81ed584fb8b63dd5
-
\??\pipe\LOCAL\crashpad_3880_XPAQGQQUDNKKPGXAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e