Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 15:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pqwtazepazxe.top/1l2d
Resource
win10v2004-20240412-en
General
-
Target
https://pqwtazepazxe.top/1l2d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2440 msedge.exe 2440 msedge.exe 2448 msedge.exe 2448 msedge.exe 5068 identity_helper.exe 5068 identity_helper.exe 5236 msedge.exe 5236 msedge.exe 5236 msedge.exe 5236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2448 wrote to memory of 908 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 908 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 1556 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2440 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2440 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe PID 2448 wrote to memory of 2084 2448 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pqwtazepazxe.top/1l2d1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc824f46f8,0x7ffc824f4708,0x7ffc824f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5246527484737696956,8333035057395209089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD55e2f0fe48e7ee1aad1c24db5c01c354a
SHA15bfeb862e107dd290d87385dc9369bd7a1006b36
SHA256f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9
SHA512140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57e0880992c640aca08737893588a0010
SHA16ceec5cb125a52751de8aeda4bab7112f68ae0fe
SHA2568649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2
SHA51252bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
432B
MD53ad6bb3d98ba5fb194817f856261d283
SHA11182824202126ad6073936940ab653e4afa67fda
SHA25620ce51e253c76dc49d709e9f1580a79c9a26a292967ae3d1007fa674b4378f86
SHA512e5de5dacc03c915cac19ac35f6c56a4daa7c37d9ac7414f444c79e0ae1bdf695dfa555b74cb6b508e833b231bf87c412e692da49ed09fb801b335f3a7e554a1b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD5fd812e1659a1dbcc075aeecc5a3ad53e
SHA1ace6989199b95c1eb8a70aa30aa0dae9f396ff4d
SHA2566ee9e0a62d1055ae7d8d1f4d44b7002ae8047ac239e572c14d69e4d726eea9d0
SHA512c9f7f9d2d622e30403eb0259de809abb410e64d3760f6a5909a017ca30c05234d66d6f7f41659b588be456ecf4d9600a45ddd02da74f28a9bacd20c4852a1fb2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
874B
MD5777c3e3fef0ef56c72505fd9a72fb88e
SHA1dfa24f099dcab48104b1fe071e45c1cb752568bd
SHA2567c01166efc6c45dc9aff52a590b71ba17e154bedf773872c0e9eb9be0c79b7bb
SHA5121549947eb32fbcd007fd76631c5d7edc047ad4957809908afe5a92087be26a1e67cde821c7ba1a1495a8a6d7c64af46f5708c2efeb9b86db12f692c278074e56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52330308fff5f9bc8889ef384e9423202
SHA1ac7a1f5c90fd4b17375564bd4542bd18889fc327
SHA25694b0367954bf4e9fc4352b9ea50cf967c8aa9c163d6f6e9c6bfc7a3d43ff8375
SHA512b87eb9a322d99ffc4f733cf81fcbf59e8cfc149e51b37b132af4f3a8b35d445bd5f8b74f1b25d01f488b2f6fa50b8b67d9fa599598015803e185f37eb160d03e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD55db767a83005a9d24f177235e4334bd0
SHA1ab0265754772ece35da88266358e0739fff41d0e
SHA2565181e18cd528d5e7605fcf3fd683d3fe87e249fd1b53afd245407ee6e922f1d2
SHA512df88eae0decbe1170bc2cf03929905999094b0f2378eae36f67ed5ecf219439359904357ccf2f649231826c283cb72519f4d51601e9ef5e644ec5b94c012db44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5928df209aa8ba8ef1722699d6efb0b80
SHA1dc7ce71b9364f4a9355305139c371210865dca7b
SHA256bd25801e7301ec4fee3e0624e197c4d3e191969e4ff04963dfc31c6c1b07c533
SHA5121e47975c96ca854e1960a172fa6a91933aa41b7cab1cd0edd6ac3baab548eecf45a3e03cc7aacfb1cec33ffcf593d64f32537386401d2d52532c8bcbd886d38a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5735ad965ee7fda2f54df7bb14fca94d8
SHA16e4b22b144e761161fe75d9b3cf21645e6c68cec
SHA25674a7d26850edc4b521b795ea6d0babfa7992eb6302fb9a5ccb0451d219560072
SHA512636d7fecaa128a8dc940e7033c11b5c15fe8e91e640a3dddcaac9d7a6bbecf2ee0b5418971340e73543c160dbe5fb16e34bd1bf54a29edc0d6ddef3fba2f0655
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD561389567b989768738fdff1f6e3b9b0d
SHA13ef31bef42c245910f08dda72d067b4063338866
SHA2562527b2c6681d5018dba9c09ba9f1a3018d88c26f7a95d5d748773323b9b86cf6
SHA512a5daceaae3f189637b07407a9b6261324c8c956e7b112a9dc68c5bf5ec45bd8dc4adea68ff1182a332d260c4e49e2c5db42f0afd431ed49b6dc6a86f502dc6e3
-
\??\pipe\LOCAL\crashpad_2448_HOXWXBQMAPCAPCVDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e