Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:27
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 8 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-553605503-2331009851-2137262461-1000\{EC4F1AFF-93EE-4501-B4C9-5899EBFCD74B} msedge.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949 msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exepid process 1580 msedge.exe 1580 msedge.exe 1628 msedge.exe 1628 msedge.exe 1984 identity_helper.exe 1984 identity_helper.exe 1212 msedge.exe 1212 msedge.exe 1212 msedge.exe 1212 msedge.exe 1632 msedge.exe 1856 msedge.exe 1856 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1628 wrote to memory of 2072 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 2072 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1552 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1580 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 1580 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe PID 1628 wrote to memory of 5060 1628 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:EU:fb6394e4-f00c-4c9f-af97-c692553d59221⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93d8446f8,0x7ff93d844708,0x7ff93d8447182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=1924 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,8673045088647586713,2510425337121491525,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58c91c8582b0c918416d14bd7eedd686e
SHA1b2ff8149bc21144fdcec64111afda492965c6621
SHA2561e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
SHA512a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52579d07b98bbefadc929d80fb3dbd32a
SHA11ceb57c4b81f0f23500e118a4b9a225116a467de
SHA256b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
SHA51253522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
768B
MD56124fb3401548909aa39cdb0bac5973d
SHA17b2028290a88959096339ae84df68754a47fa02c
SHA256889932a8fecf77fb3468fb80af8729c7395d70895524077d68140c90ec237479
SHA512e8c6e8262e65c235ee2c45d1b2ec2857e77faa1e75fc8844ffdf4744776bdca63992492c125d77b44169437684dd6bf0b4f18ceae7cfac05a4da46ee94b6e7aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
888B
MD5f95dfb18bee4afb53e5c8fa1011041c7
SHA1573cb58acef492c4d03624fe65c78ee81d426af0
SHA256c598a099d3307868966fbb91fcf1d688a2f1b57a172cff399c4c04a4e3dd6a07
SHA512f5e4a9775e6adc021bfa7c20c23bab9f3ddb696980fe0baa549e38b525a6a080edd77c8cf9f505c10713153b1df3de5208eb15e90155a11f16c92911811f7cb8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f0413644c6a06fdbb3073c717b6d0be7
SHA137914b88e027c9b77898f41c32e561d380f24e7b
SHA256e193d6021d9a8d7e8bd71aa7df67d2bf6aa82f5a3d689001f92524a67f78caf4
SHA512f565be231def922d5a74986d1f83205178e92c0bbae4883997667c651fef2acb66fe372dbf6415f19f590010f5fcd1bd749d856a1e06c1096652d5d262dd2b96
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e2299e081b8153bd2ec26286ed50f06a
SHA17642b894be6f5bf41b0c35d992e0ccefa923a1c7
SHA2564dfb819b13865a70047a29e5241d53c88aad3c37d260dbcf25d25513f7dc407c
SHA5124398f5fef7fee4a781e4161584ce2b13f360995f3e57b6b939606a0d547134d099be2659226cb5c41df28a64aa84fee16ddac4ce122a06fc53562ef3848b8f2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d64b191d95688e698021887d8da83b77
SHA15ee5f742c84d5eb4b83f5269f5aa856477924ce3
SHA256f8fa1276f66abf6555ee16ec815bba8bb8d288f07278bb6a7c8a58d04efa5d2e
SHA512683673353930d42fe5b431c09ff9d2612fdcc534478269e563f0e346d071361e2729080a631d6fa0f813996d50edffd5d85110e3230595a3e22e5c0d107ad93a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\LOCAL\crashpad_1628_VFGHOLIWIQJOHXDUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e