Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2024 07:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcommujity.com/gift/906353439838
Resource
win10v2004-20240226-en
General
-
Target
https://steamcommujity.com/gift/906353439838
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{81C653A3-851A-4414-BC50-3FFAD82A4271} msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 4600 msedge.exe 4600 msedge.exe 1628 msedge.exe 1628 msedge.exe 4628 identity_helper.exe 4628 identity_helper.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 712 msedge.exe 712 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
msedge.exepid process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
msedge.exepid process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
msedge.exepid process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1628 wrote to memory of 2000 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 2000 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 3892 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4600 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4600 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 4208 1628 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommujity.com/gift/9063534398381⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd404646f8,0x7ffd40464708,0x7ffd404647182⤵PID:2000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4600 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:4208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4024
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4272
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:4816
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:3672
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:12⤵PID:1700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:2836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1896 /prefetch:82⤵PID:1260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:2504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6004 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:12⤵PID:2660
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:12⤵PID:732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5752 /prefetch:82⤵PID:3064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1872 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1244109895712746234,7232124639834757093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
672B
MD5d970d42c86521bd731a20efd0c708451
SHA19b49ebc69b3eb7b3256514a906cfdea24012b0db
SHA2564a5632ca623e1ade3f04ae1abcdccdab5a9b5c38f467a629b05718012b6280c2
SHA5121342d368c3f2541c25443d98d534550f6630be2d895670abac1b163b49764e733beabe25d4c802bea5df5992d9fbf6db76e106004d5ce1a79c6a46fd630b22cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
648B
MD51216b76e4b42584c9d2c4d97dc85dc3c
SHA10c9ea5379cb2feaafdf09db4aae87b5aab8c2009
SHA2565c8e283bbdc458042ea6980154fef34cea982ffa483da42f860f3a0f07f7d000
SHA5129493bb58f608e62d01efa1b387211d514c713f3cac4f8d923d331c847c7b6d18d99b09bcdc9fc159b98dfa658a535f7d483a26684d56166b68b65afcecb14c76
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD56db6e54ec8e70550c0d6de24866d3ee7
SHA1c0574c58aefa6bcf410d4548894f5387f466ad27
SHA256480a6253755efcce3095731d36198657fcbbe657da11a71790f191d421730b2d
SHA512895b96756c0c8cffa662078e8cdc8d1ddc36f3e5884d31a16cdb6d35f86fe9016a47ed4e227c3149c94f9fe6acecf615037d4b3c7a955f5753214b2cae17d6ac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56209017c254a1f59e5ae8c433497ae83
SHA1280e07cbbc678525f31f031934610f2f56598e07
SHA256c473f7a344f39588adeb5516fd19363410f369224881a7068572cfc27ead6d93
SHA512f3271eef2ee73efd72f6ad4670e82bd5ccfcfb1f26dc40bc11183e5d1e7b789229a5f5a3edc480acad5b83bb693d346ca840c1d162bc9d83a2da01f8f1e78e83
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD58bcbb64aefa384aad0ecdcab10a67820
SHA151e3659c0d6a5e34c9705a3c8a8cf382d814dcb7
SHA256699413671316851469e6d6ed8401af89c32bb15536f5b71252e1815e91c49bc7
SHA512eebc23aa1da827f6376ba00a5d0fb7811effc84f45ac8c9bbcbdc2a0bf5b7338f9eb1280cffdc28dc79e99d5104f7893f42f1494fc242dee5cde3041d280fd11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55d4825922bccf9d8d1ff6da3798a721f
SHA1c42d54a11c3ce1c5b2632ec9707f184ac21b8f08
SHA256ef70a53f8e072ce1837a9d6b7e65572671299486b9ae119541ac30b5c99a600c
SHA5129b9e18adc1f3b59564acfcbe01a8f5ba633b17ccdea58b86273736c5a1c8ab71033e2da1e0e0b4204c0f78699576183e62cd5de99e480220d3cfae656092d73a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD59c01a563d6f8e29432361b605b8f913d
SHA1b77147d19ecae1fb7cdeec5085d33cf8b902cea1
SHA2565edced6bbe045c18abd05811d10deb3940123dba0b825ddabcf8d32185890039
SHA5129e1e7fb7088a9d0b1eb6ac9b3def92117593d4e7d01b582cdaf0f11da0f259ef10af3abffd22595234297a4a77c57a1c2639c024fd4dd1bf3986f45c8de55f24
-
\??\pipe\LOCAL\crashpad_1628_EFSMNCMHWPETWVKDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e