Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 11:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sc.link/mJpNp
Resource
win10v2004-20240412-en
General
-
Target
https://sc.link/mJpNp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3936 msedge.exe 3936 msedge.exe 3540 msedge.exe 3540 msedge.exe 1944 identity_helper.exe 1944 identity_helper.exe 3956 msedge.exe 3956 msedge.exe 3956 msedge.exe 3956 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3540 wrote to memory of 4936 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 4936 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3536 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3936 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 3936 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe PID 3540 wrote to memory of 2136 3540 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/mJpNp1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c6746f8,0x7ff91c674708,0x7ff91c6747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13573111741680433016,16290912146986305813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b56675b54840d86d49bde5a1ff8af6a
SHA1fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811
SHA25686af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929
SHA51211fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD548cff1baabb24706967de3b0d6869906
SHA1b0cd54f587cd4c88e60556347930cb76991e6734
SHA256f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775
SHA512fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD5ea18c95a69dd541dd3939505081a6571
SHA1bf6f9d5607d88859bd576951e45ba280d858e9ca
SHA256167f30b5538264b1b0f8dbce2e501b29913664d4beed92b79b8438a3049bdcdf
SHA512b6687cf3707401e315b43833a9344da4309c606c57eeab998022dfdde4588691b9896aca27fb0be04846f2ea0e92aaa8650e14681b9b0f9612c89d24b59e5c03
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD58e13165bbd2ae69cc0231c8f8597ca6f
SHA1d32980b4d4c539d54276b16d574d5e2fd4f5517e
SHA256717e72b32eee5968eaf66978807620bf368c4d7471d61fbad5cb3c374b90adde
SHA5120540d76398633ace1015e09f1799d48fc9ce719d92c0528dd1811889c20c6a34f374336aff6a3451723836e397d235e14b5ff8ffd0b3483da10192df84f0d6e5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
721B
MD55f2629754fe7b35058c350c659b94f97
SHA1403cdd2d8b21c010e2519b915df8349c76878550
SHA256d00c1c64bef919f7fb7b81d04bc58205b31cfa34f0f753c40a6f0625854ce3b6
SHA512fc0868bde2b282980feab95de43a7997229539d70fea63b7043f68c32781ed3b35c5693fa271762dfdc143167bebf3f4aecdf7cf741cdc34437c5ec05b9df1d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5035737c8e406277ec25689b08d216de2
SHA1c870fab4ee24f2597c9fec4b9397e95a04cc8096
SHA2563659d719adfe54317ac343eab137160dade7387bd5abd8faa6078aa9b02b1de8
SHA5120e80954ecd26e78b60bd419008efb424b2e74467fef41c87eff61ea2dc82e10073f8e51f351f8fa79cdf08a767dfd33cfc5184fd80e05021e84a3b90b32e5847
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53def755e845cddaf4c22bf70a9c4c26f
SHA16efa396adf4c2b1bc0250ce89fd8e53c08f4f4b0
SHA256617b9e84b78f5a854f456cc43660adf51afd10d9297b89638cf104a7b0b14313
SHA512851e384b194068e5133a97b00833a6baf4af843fcb31f539554a985d6d717d3bd068fba96ed03e2aa1c66a315e348589850881bc01b0b5aaa1184dda670f4f68
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55f5ea308984bc60583b753def92da1c2
SHA159c13a70ac41432e8585fdb45d34c6a181d557e6
SHA25605e846bebb6f9594c7cadc5c3084cd4b5f06c98f4ac63960fd38c66d79c8f87d
SHA512c5ee12f82b37eab47ce8dd40424276cb0bde288a0d3ee42b786d8039d15f0f1305db11ef64872364a4023f1076d37bdb4139d08196a64cece990860bf57fa8cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f5861f97b7e9240d0bcfecfd1250e2ed
SHA1f4e1dc1170f3586888667421927465d21fec85d4
SHA256e925659cc807e0f0bec1b01a7dc000db3dd6b3797ee5d25dafb1e8c9bb823fe3
SHA512e9a6c9fa7efef07adf503af6a6f17f471c1590466f7281b86c4bb09cfce72175df8277ec4ff568656398645dbb3bf5d0129910f206e52178e1e4af1324abb4b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5029c492aa14c174de29aa1dc850f8bbb
SHA1c3eb109d8b2654ac9dc90f78368ce9f495226870
SHA256901451fd282306a3586a99c839c5bd7af2a5bed2647d91f5a6b58d3eaf23c751
SHA51290e43f7b5eb40b0e91ac0084bced134d30d8dcaaadf9f46dcf1e0a7dd4f052c57fbf447aab3531880eb5e24d644b3bacbf4eccc158aedd265c92ec1a87eb865d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56bc6a72dd2f242745fe66e927fb2daa8
SHA13a71afac8618671b928405f736faa3f3de5ce06d
SHA256e7943454cfc213c2c0310e89fc544842c7d0e6342c4010fc1dbd76bbffba2240
SHA512e29bdb7ae3bdfee30be21256d5599ea44ef0ab3ff5943ccfe4ea13b0b8a136d82b1b027758850015a9e740d8330d4e71a8f36b63e8eee63fee3f5023929b5dfc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
704B
MD53469ac802de5b4a5fbdbfdc92e8ade44
SHA15657a9d455b456ecb16fa6bd15768848c7c1bdea
SHA2565ae5e6be48b53ed0396ff7e79f2162e8ac9a155792a81005b3d4fcf0f6889787
SHA512d73fcd807a1031785d1109913ee21ce5c73b0bc5bfd116dbcd5de6e96a9ed1e8c2db0cf70d22afd00b4e359954fa742ea4a28d6783801d585a6579cfd80bc123
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5878a6.TMPFilesize
368B
MD58dbdcf3ce1138cc6ce11e8043b396e62
SHA18863c6b0ed2a9a83bd90f341642b3246cafc4cc2
SHA256104806f9e4827191172bf6433429d15eec95096f1f7d88d546c9a6f17bde47e5
SHA5121d61aaebb84c016a9a950d77d0824617873a2bc63f552fae0e916ebbcc7231f97398c916afc03264da15eb058c81ec6d5b72a60b0b7baa7404fa124280df91a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD532e81a680c64064c80a309a3845a5b34
SHA1b5675398cfce8917ad1d91dc8ff785a2dd96741d
SHA2563044b6482db5b765bf44315cbdc0b969045bc0a657a5aa48b092c747acd3a1e9
SHA51295edf89c331ad3ddafbf3305df4ea77ca6ea14b995cb8868aaa30991836267a97cc27076d0d9d61b13b67cf62909044a9dfe09383de175710ff73056b95da4c6
-
\??\pipe\LOCAL\crashpad_3540_EUPONJJMMPTPBRYPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e