Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 21:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go-link.ru/Pb30y
Resource
win10v2004-20240226-en
General
-
Target
https://go-link.ru/Pb30y
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{4D1A4E99-178F-4447-A70D-76966A58B8E8} msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 1912 msedge.exe 1912 msedge.exe 4716 msedge.exe 4716 msedge.exe 8 identity_helper.exe 8 identity_helper.exe 3460 msedge.exe 3460 msedge.exe 5684 msedge.exe 5684 msedge.exe 5684 msedge.exe 5684 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
Processes:
msedge.exepid process 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4716 wrote to memory of 4600 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4600 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 3404 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 1912 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 1912 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe PID 4716 wrote to memory of 4884 4716 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/Pb30y1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa93e46f8,0x7fffa93e4708,0x7fffa93e47182⤵PID:4600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:4884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:3404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:1048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:1816
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵PID:4836
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:8 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵PID:3228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:4336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:4352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:3712
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:2012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4844 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4812 /prefetch:82⤵PID:3228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:1796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:2472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:2320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:1692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:5528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:12⤵PID:5536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,14260385704239771068,960983682435009461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5684
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4456
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x2f81⤵PID:5820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040Filesize
305KB
MD5aa3ef1e1f1c1646532335eb852c78c38
SHA1a2cf863f09aaf64df711cb8abc1a013c966604b1
SHA2566e61aba5af2099b3f3ea36e7959d3649b9c36bb6ab0c13d1637c83bc8a807ad6
SHA5125acf56de5db9c4d7c0b317cf7862855004161579989f49cecd726a0c188f50547c7f5721375c4c0667d63a1f0deab33b9158ee9f9f60b8dbf24f3725b0c76121
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD54508b050585bd9fc88149a91a627b932
SHA1919e813bc395e909d30c1d7e5c34f7db30896d6f
SHA25612c07263c8beff11d0e20cb5016ce362ed37e475a73e6e017607a9b06dbadbda
SHA5124a228108e9bedb3f0ca84e923eddcca0f644b295183a8f9986b5b01d0c916cbbbf3c99baba8d0ebfc14a9d1ce5b43823d92777f77ff8b2810f0514f80d5e7aab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD5a5ba824917c127fe56d3b0d8312e080a
SHA121a077afa35aad9d982296f3d021ca108896c912
SHA256ae67d07eaed8541540f135f9712d0a6021c961e702bee45c7a8392bb6f8ee61c
SHA512f40f34aa63d61f12c81e25969ab4dde20b8954ccff1e51f1e95faa42456d616bad39031c96f66d51578a805061e2813c474e08f13f887da335941a0c2e7f1790
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD58ee538b7befe7a1a96b999404897b9d1
SHA165a48878e8338e1fced053eaa6f2d5e2a0f48e23
SHA25665758047b089c6a6cedb57fb3cb07642a611f83823e32cbef27b54a93577963a
SHA51285678b8f99a964805363ee47654c93936619b93f5cd7df0b1d1caeb03e0debabc6a3af55c854890d232d45117417e973ae2598b7666a8d7783f8aa9b274558de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55e5584e4fd1ffea1e30288d5aabf9c63
SHA1ff02b3e428d1bf1a084681c1e851ebe5234f7edd
SHA25636fc642e726b87495e8b3c71f68bdcfc45aadcf5ae540753ab803bf43a529435
SHA5126ce824ec39bb78859f97a25f2c21c0dcc68b74ace3524418c01eee5a2288172e9f3de9fca895e10d8fa6ed3450ba29e55d25e0432765c4c779927f20193dc110
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD50b7da19d008e93ac70d4619d5932c3e9
SHA1bbc8bfd58216ad1c1b731919ab773368c7d1a3b4
SHA2563049f0736f1d28486d2317c46a1f7752fda7c385a258313fc325f011527365ea
SHA51258d0d7cddf770754c97e1848b6f973e5b4bc3c128ada10ea828867b9d09826444ae70447db9d99e247935d349b1d096bd80d84fda1bff12b90c28147a9000bbf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD56e1bbe026a83f4e7f2391645af4688d0
SHA131da7f33a94016f217b68a104302ab5d271703c9
SHA256ca3ac78516385441bb43863d227e4fb717959fe24c98774b80ca95c8d0ff863d
SHA512927a1b5642c3aa9f0d5ac8ea80e1c1c0459aa191bea4c11ec33cb1341a6d49d411712cfdc859978754be5cf20d6b27d3ab257448155f59011a187c462bcfc430
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5455b2195b7fe5052581e90c0d14d07ca
SHA198ce3ad180804f8029d177be3e8de2e02a577e94
SHA256991ed3538d001d4fedffb5c4576e2e18ea9d9ca16dadb61b2b54398679a72d6c
SHA5127d98aa2562180d9a40f7e1240da0b1187f066485ed71b78ee85bb7b348aff635432d2a983dd86bed3876e6b33948d387e15ecdc069ce9ba5d77d05d833b7ab5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD50e1d8c4ead0fe81ab21d735a50c3df71
SHA13bf360cbfda8f2824f2542c6082f3b3141d4b4b0
SHA256f1f8fd940b2bf17c06e5452f8c69b945b239d1677025c2f55d45d576bc8a5d8a
SHA512322422c2e84ae40a6af70743ba0c80114aed9477d9002f3bd26ed28d5c1de7906efdc16dd641b23045b1c50b824777d220beb66ad739b9ed16d1f6b357002d38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5b1faa362ceaf0cbed6758941282569fc
SHA15b804f7f73a3ce191f9860a36a9a8962ba940b06
SHA2567823c56b8b2e76a48b77c4f49144e951511f27ed83d06da8357f59d9ce3f6789
SHA512ac17f03192a6808829a5d1d7bb6b9575c9a4a6240b2d7946381db7d6e4912204ce3befabeff0eaf29ec643a951db1cd9c13a029fa3f0e41e003a0ecf382346ea
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a9dc.TMPFilesize
537B
MD5c738eb8093b0c121a404443b8fd2aade
SHA1ebae0f912a59a2ed21965ad575d907871e6c31aa
SHA256f0868fa22af2f37203eed3bbf5bbf5240377f708d6738106e8e85950c6ded0aa
SHA5125461ca41f6ea541e918d95e92886c29a81f833e32368b59a92c17523ec64f2f0165f4cb7563f3a1cbde760c013dffcf50a79346c805dcc518880f29ce596c0f9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD59dd25cef72105034dcaafcb532a09a44
SHA1f20cd36940290810622673eb74c1e9d6f1634a09
SHA2565b33b938ad11b482476fde481efaea7016c2568c2cb2238b1ca2401fe360bd9d
SHA51254bf3dd660a6b6bfd893eafb79f4781e166c1261446862ac8e99642c4abe89bab4005f1d609751cb3881d70cf89b9c9377cd5f456907669333a46209760f63b5
-
\??\pipe\LOCAL\crashpad_4716_AMGFCSHTSTIRGZCBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e